T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyze.py:17- Finding
Hard-Coded Enterprise API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
识别5300中银行流水样式、识别简版征信、详版征信、企业版征信等各种信贷文件汇总成专业分析报告。
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it handles very sensitive credit and banking documents through a third-party service with under-disclosed data handling and an exposed embedded API credential.
Review before installing. Only use this with documents you are allowed to send to ipipei, avoid long-lived public URLs, and do not pass PDF passwords on the command line. The publisher should remove and rotate the embedded enterprise key, add an explicit consent/privacy notice, and provide safer password handling before broad use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.py:128- Finding
PDF Password Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:14- Finding
Unpinned Third-Party Runtime Dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill processes highly sensitive financial and identity documents, requires users to provide publicly accessible URLs, and may transmit optional PDF passwords to a third-party service, yet it does not clearly warn users about these privacy and security implications. In this context, the omission is especially dangerous because credit reports and bank statements contain PII, financial account data, and risk signals that could lead to identity theft, privacy violations, or unauthorized data exposure if mishandled.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code uploads credit reports and bank statements—highly sensitive financial and personal data—to a remote API, but provides no explicit consent flow, privacy notice, data-handling warning, or validation that the user understands third-party transmission. In this skill context, that is especially dangerous because the files may contain PII, financial history, account data, and passwords for protected PDFs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill invokes a networked third-party parsing workflow but does not declare any tool scope, permissions, or allowed-tools boundaries. This weakens governance and reviewability, making it harder to enforce least privilege and increasing the chance the skill is used with broader network access than intended.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction '用清晰的中文向用户呈现' requires responses in Chinese, but the skill does not provide a language preference option or explain that the skill is limited to a Chinese-speaking context. This creates a natural-language policy concern because it forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
All user-facing text, help output, and argument descriptions are in Chinese, which effectively forces a specific language without offering opt-in or documenting a justified locale restriction. This matches the language/locale policy concern for natural-language behavior across file types.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script contains a hard-coded enterprise API credential in source code, which is a real secret exposure issue. Anyone who can read the code can reuse the key to obtain tokens and access the third-party service under the organization's identity, leading to unauthorized use, quota abuse, billing impact, and possible downstream exposure of sensitive processing capabilities.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The script transmits user-supplied document URLs, analysis metadata, and possibly PDF passwords to an external service via HTTP requests. External transmission is expected for this skill's functionality, but in this context it still represents a meaningful security/privacy risk because the data involved is sensitive financial information and there are no compensating controls such as consent, destination allowlisting beyond a fixed host, or masking of secrets.
- Content
python if token: headers["Authorization"] = token url = f"{BASE_URL}/{path.lstrip('/')}" resp = requests.post(url, json=payload, headers=headers, timeout=timeout) resp.raise_for_status() return resp.json()