Security audit

发布（智能体一键部署与上架）

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates creating, uploading to, testing, and publishing a Coze customer-service bot, using the user's Coze token and selected knowledge-base files.

Install only if you intend to let the agent use a Coze API token to create or update remote Coze datasets/bots and publish an API connector. Use a least-privilege token if possible, keep the knowledge-base directory clean, and do not point it at folders containing confidential documents you do not want uploaded to Coze.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes capabilities that read environment variables, access local files, and make external network requests, but it does not declare corresponding permissions or clearly surface them to the user. This creates a transparency and consent gap: users may provide a token and local documents without understanding that the skill will exfiltrate those inputs to a remote API and create external resources.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file markets the skill as an 'AI客服机器人「产品说明书」生成器', while the skill metadata describes a Coze API automation flow that creates knowledge bases, deploys agents, binds prompts, publishes services, and prepares store submission materials. This mismatch can mislead reviewers and users about the actual behavior and privileges of the skill, potentially concealing higher-risk automation capabilities behind harmless-seeming listing copy.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The advertised capabilities in the body text are limited to generating design checklists, pricing suggestions, and sales copy, but the manifest says the skill performs end-to-end bot deployment and publication through external APIs. A capability-range mismatch is dangerous because it obscures operational actions from users and platform reviewers, weakening informed consent, auditability, and risk assessment for a skill with external side effects.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger description is overly broad, covering many loosely related requests such as creating, deploying, publishing, or building a bot. In an agent environment, ambiguous invocation criteria can cause the skill to run in contexts where the user did not intend credential use, document upload, or remote publication, increasing the risk of unintended external actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill asks for an API token and business documents to perform automated publication, but it does not clearly warn that these inputs will be sent to an external service and used to create or update remote assets. This is dangerous because users may unintentionally disclose sensitive business information or authorize destructive/account-changing actions without informed consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The default behavior auto-uploads documents from a local directory, including bundled template files or user-provided materials, without an explicit warning about external transmission or content review. In context, this skill is specifically designed to publish assets to a third-party platform, so silent default uploads materially increase the chance of accidental data leakage and unauthorized content publication.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code reads all .md/.txt files from a local directory, base64-encodes their full contents, and transmits them to a remote API endpoint. While this is the intended functionality of a bot publishing skill, there is no explicit confirmation, classification check, allowlist, or warning to the user that potentially sensitive local documents will be uploaded off-host, which creates a real data exfiltration risk if the directory contains confidential material.

Static analysis

No suspicious patterns detected.