T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:299- Finding
Unvalidated Report URL Permits Local File Disclosure and Unintended Network Access
- Content
View full analysis
- Remediation
View remediation
Security audit
ZeeLin Deep Research 深度研究
Security checks for vulnerabilities and agentic risk
Overview
This research skill is coherent, but it should be reviewed because it automatically moves reports through unvalidated downloads and Feishu/message channels without enough safeguards.
Install only if you are comfortable sending research prompts and generated reports to ZeeLin, and, on Feishu, having report text copied into a Feishu document. Do not submit secrets, regulated data, or sensitive business material unless you have checked the provider and workspace policies. Prefer runs where you can inspect the returned report URL and file before forwarding, and avoid shared hosts or predictable /tmp paths for sensitive reports.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This workflow downloads a report, extracts its contents into plaintext locally, and uploads the material into a Feishu document without any disclosure or approval step. That materially increases exposure because confidential content is duplicated across systems and transformed into easier-to-search plaintext, potentially inheriting broad document-sharing defaults.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file instructs the agent to prompt the user in Chinese when no API key is provided, and other canned user messages throughout the document are also fixed in Chinese. There is no indication that the skill is restricted to Chinese-speaking users or that users can choose their preferred language, which conflicts with the language/locale policy criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends user prompts and session identifiers to an external service but does not warn that user-supplied research content will leave the local platform. This is a privacy and data-governance issue because users may provide proprietary or regulated information without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The example sends arbitrary user research content and an API key to an external endpoint. In the context of a research skill this transmission is functional, but it is still security-relevant because the skill does not constrain data sensitivity, warn users, or minimize what is sent.
- Content
bash API_KEY="${DESEARCH_API_KEY}" curl -s -X POST "https://desearch.zeelin.cn/api/conversation/anew" \ -H "Content-Type: application/json" \ -H "x-api-key: ${API_KEY}" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow requires downloading generated reports into local temporary files and forwarding them, but it provides no warning about local storage, residual file retention, or host-level exposure. Sensitive reports can remain on disk or be accessed by other processes/users if temporary-file handling is weak.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This repeated API submission pattern again transmits user content externally without safeguards or disclosure. Repetition in error-handling examples reinforces unsafe default behavior and normalizes sending potentially sensitive prompts to a third party.
- Content
bash # 检查返回码 RESULT=$(curl -s -X POST "https://desearch.zeelin.cn/api/conversation/anew" \ -H "Content-Type: application/json" \ -H "x-api-key: ${API_KEY}" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The full workflow submits user questions to the external provider and stores returned identifiers for follow-up calls. While expected for the feature, it still creates external data exposure and session-linkability risks that are not acknowledged or limited in the skill text.
- Content
bash # 1. 创建任务 API_KEY="${DESEARCH_API_KEY}" RESULT=$(curl -s -X POST "https://desearch.zeelin.cn/api/conversation/anew" \ -H "Content-Type: application/json" \ -H "x-api-key: ${API_KEY}" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The workflow downloads a report from an external URL to local storage and then forwards it to the user with no integrity, type, or size validation. That creates risk of mishandling untrusted remote content and propagating unexpected files through the messaging channel.
- Content
md echo "PDF URL: $PDF_URL" # 4. 下载 PDF 文件 curl -s -o /tmp/research_result.pdf "$PDF_URL" # 5. 发送 PDF 文件给用户 message action=send target=用户ID filePath=/tmp/research_result.pdf
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This instruction makes file download and onward transmission mandatory, encouraging blind forwarding of externally retrieved content. The danger is amplified because it forbids a safer alternative of returning text directly, forcing local file handling even when unnecessary.
- Content
md PDF_URL=$(echo $REPORT_RESULT | jq -r '.data') # 下载 PDF 文件 curl -s -o /tmp/research_result.pdf "$PDF_URL" # 发送 PDF 文件给用户 message action=send target=用户ID filePath=/tmp/research_result.pdf
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The 'download then immediately send' pattern forwards externally sourced content without validation and normalizes automated exfiltration to the user channel. In long-running workflows this also reduces opportunities for human review before transmission.
- Content
- 任务完成后立即发送：在轮询循环结束后，立即调用 message 工具发送 PDF
bash # 下载 PDF 后立即发送 curl -s -o /tmp/research_result.pdf "$PDF_URL" message action=send target=用户ID filePath=/tmp/research_result.pdf
- 任务完成后立即发送：在轮询循环结束后，立即调用 message 工具发送 PDF
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Feishu-specific workflow expands the trust boundary from a research API into an additional document platform, and it instructs extracting report contents into local files and uploading them to Feishu without user consent or data classification checks. That creates unnecessary cross-system propagation of potentially sensitive research content and increases the chance of disclosure through the wrong channel, tenant, or sharing settings.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
In the Feishu branch, external transmission is compounded: user content goes to the research API, then report content is later moved into Feishu. Multi-hop transfer across providers increases confidentiality and governance risk, especially without explicit user consent or workspace validation.
- Content
bash # 1. 创建任务 API_KEY="${DESEARCH_API_KEY}" RESULT=$(curl -s -X POST "https://desearch.zeelin.cn/api/conversation/anew" \ -H "Content-Type: application/json" \ -H "x-api-key: ${API_KEY}" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
Downloading a Word document from an external URL and unpacking it locally for text extraction handles untrusted remote content in a risky way, then prepares it for another upload target. This broadens attack surface and data exposure while lacking content validation, sandboxing, and disclosure.
- Content
md WORD_URL=$(echo $REPORT_RESULT | jq -r '.data') # 4. 下载 Word 文件 curl -s -o /tmp/research.docx "$WORD_URL" # 5. 解压 Word 文件提取文字内容 unzip -q /tmp/research.docx -d /tmp/research_docx/
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest presents a research assistant, but these instructions add generic background task execution and process polling patterns (
exec,process action=poll) as operational capabilities. That is infrastructure/control-plane behavior rather than core research functionality, and it is not declared in the skill description.- Content
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- SKILL.md:49