T09 · Insecure Skill Coding Practices
Warning
- Location
gitlab_weekly_report.py:16- Finding
GitLab Personal Access Token Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
gitlab-weekly-report
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent GitLab weekly-report purpose, but it handles GitLab tokens unsafely and disables normal network protections for authenticated requests.
Install only if you are comfortable editing the script first: remove curl -k and --noproxy *, avoid passing the GitLab token via --token or curl arguments, use a least-privilege token, and rotate any token that may have been used with the current version.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
gitlab_weekly_report.py:16- Finding
TLS Certificate Verification Disabled for Authenticated GitLab Requests
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill embeds and normalizes handling of sensitive token and personal account data in plain text, including a token placeholder and saved configuration fields for user identity details. In an agent-skill context, this is especially risky because users may paste real secrets into prompts or config, which can then leak through logs, transcripts, screenshots, debugging output, or downstream tooling.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
This duplicate finding points to the same risky behavior: the tool invocation is crafted to evade proxy inspection and ignore certificate validation. Because the script uses a personal access token for API access, the misuse of tool parameters could expose credentials and reduce organizational visibility into outbound connections.
- Content
python def curl_request(url, token=None): """使用 curl 请求 API（更稳定），绕过代理""" cmd = ["curl", "-s", "-k", "--noproxy", "*"] # --noproxy 绕过代理 if token: cmd.extend(["-H", f"PRIVATE-TOKEN: {token}"])
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
This duplicate finding points to the same risky behavior: the tool invocation is crafted to evade proxy inspection and ignore certificate validation. Because the script uses a personal access token for API access, the misuse of tool parameters could expose credentials and reduce organizational visibility into outbound connections.
- Content
python def curl_request(url, token=None): """使用 curl 请求 API(更稳定),绕过代理""" cmd = ["curl", "-s", "-k", "--noproxy", "*"] # --noproxy 绕过代理 if token: cmd.extend(["-H", f"PRIVATE-TOKEN: {token}"])
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def main(): parser = argparse.ArgumentParser(description="GitLab 周报生成器") parser.add_argument("--token", required=True, help="GitLab Personal Access Token") parser.add_argument("--user-id", type=int, required=True, help="GitLab 用户 ID") parser.add_argument("--after", required=True, help="开始日期 (YYYY-MM-DD)") parser.add_argument("--before", help="结束日期 (YYYY-MM-DD)")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation examples include phrases like “帮我查一下这周（或上周）的 git 提交” and “帮我整理上周的周报,” which are common natural-language requests that could overlap with normal conversation. The file does not provide exclusion conditions, a constrained command scope, or negative examples to clarify when this skill should or should not activate.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to pass a personal GitLab token directly on the command line and stores account details and token references in the documentation. This is dangerous because CLI arguments can be exposed through shell history, process listings, logs, screenshots, or copied transcripts, increasing the chance of credential leakage and unauthorized GitLab API access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill describes using a personal GitLab token for API access without warning users about credential sensitivity, storage risks, or privacy implications of querying commit history. In context, the skill accesses potentially sensitive developer activity and repository metadata, so the lack of credential-handling guidance materially increases the risk of accidental secret disclosure and overbroad data access.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This skill deliberately invokes curl with --noproxy * and -k, causing requests to bypass enterprise proxy controls and TLS certificate validation. In context, the script also sends a GitLab personal access token, so this combination weakens network monitoring and enables credential exposure or man-in-the-middle interception.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script transmits a personal access token over network requests while silently bypassing proxies and disabling certificate validation, without clearly warning the user that their credential will be used under these weakened protections. This makes the skill context more dangerous because the token is security-sensitive and could grant repository access if intercepted or mishandled.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["-H", f"PRIVATE-TOKEN: {token}"]) cmd.append(url) result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: raise Exception(f"curl failed: {result.stderr}") return result.stdout
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
All instructions, examples, and output guidance are presented only in Chinese, and the skill does not indicate that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language description, user-facing argparse description, and console output are all fixed in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no choice or justification is provided.
- Content
Static analysis
No suspicious patterns detected.