langgenius/dify

Its tools can

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

MCP server rules 3 of 11 flagged

    def _get_mcp_server_and_app(self, server_code: str, session: Session) -> tuple[AppMCPServer, App]:
        """Get and validate MCP server and app in one query session"""
        mcp_server = session.scalar(select(AppMCPServer).where(AppMCPServer.server_code == server_code).limit(1))
        if not mcp_server:
            raise MCPRequestError(mcp_types.INVALID_REQUEST, "Server Not Found")

        app = session.scalar(select(App).where(App.id == mcp_server.app_id).limit(1))
        if not app:
            raise MCPRequestError(mcp_types.INVALID_REQUEST, "App Not Found")

        return mcp_server, app

def handle_call_tool(
    session: Session,
    app: App,
    request: mcp_types.ClientRequest,
    user_input_form: list[VariableEntity],
    end_user: EndUser | None,
    protocol_version: str = mcp_types.DEFAULT_NEGOTIATED_VERSION,
) -> mcp_types.CallToolResult:
    """Handle call tool request"""
    request_obj = cast(mcp_types.CallToolRequest, request.root)
    args = prepare_tool_arguments(app, request_obj.params.arguments or {})
    if not end_user:
        raise ValueError("End user not found")
    response = AppGenerateService.generate(
…

def handle_list_tools(
    app_name: str,
    app_mode: str,
    user_input_form: list[VariableEntity],
    description: str,
    parameters_dict: dict[str, str],
    protocol_version: str = mcp_types.DEFAULT_NEGOTIATED_VERSION,
) -> mcp_types.ListToolsResult:
    """Handle list tools request"""
    parameter_schema = build_parameter_schema(app_mode, user_input_form, parameters_dict)
    supports_structured = _supports_structured_output(protocol_version)
    tool = mcp_types.Tool(
        name=app_name,
        title=app_name if supports_structured else None,
…

@console_account_admission(allowed_roles=_EDIT_ROLES, rbac_checks=[RBACCheck(RBACPermission.APP_EDIT, PlainApp())])
    def post(self, request_context: RequestContext, app_id: UUID):
        payload = validate_request(MCPServerCreatePayload)
        try:
            server = application_services().app_mcp_servers.create(
                request_context, str(app_id), description=payload.description, parameters=payload.parameters
            )

def handle_call_tool(
    session: Session,
    app: App,
    request: mcp_types.ClientRequest,
    user_input_form: list[VariableEntity],
    end_user: EndUser | None,
    protocol_version: str = mcp_types.DEFAULT_NEGOTIATED_VERSION,
) -> mcp_types.CallToolResult:
    """Handle call tool request"""
    request_obj = cast(mcp_types.CallToolRequest, request.root)
    args = prepare_tool_arguments(app, request_obj.params.arguments or {})

    if not end_user:
        raise ValueError("End user not found")
…

else
  if [[ "${DEBUG}" == "true" ]]; then
    export HOST=${DIFY_BIND_ADDRESS:-0.0.0.0}
    export PORT=${DIFY_PORT:-5001}
    exec python -m app
  else
    exec gunicorn \
      --no-control-socket \
      --bind "${DIFY_BIND_ADDRESS:-0.0.0.0}:${DIFY_PORT:-5001}" \
      --workers ${SERVER_WORKER_AMOUNT:-1} \
      --worker-class ${SERVER_WORKER_CLASS:-geventwebsocket.gunicorn.workers.GeventWebSocketWorker} \
      --timeout ${GUNICORN_TIMEOUT:-200} \
      app:socketio_app
  fi
…

@mcp_ns.route("/server/<string:server_code>/mcp")
class MCPAppApi(Resource):
    @mcp_ns.expect(mcp_ns.models[MCPRequestPayload.__name__])
    @mcp_ns.doc("handle_mcp_request")
    @mcp_ns.doc(description="Handle Model Context Protocol (MCP) requests for a specific server")
    @mcp_ns.doc(params={"server_code": "Unique identifier for the MCP server"})
    def post(self, server_code: str):
        args = MCPRequestPayload.model_validate(mcp_ns.payload or {})

    response = AppGenerateService.generate(
        session=session,
        app_model=app,
        user=end_user,
        args=args,
        invoke_from=InvokeFrom.SERVICE_API,
        streaming=app.mode == AppMode.AGENT_CHAT,
    )

    app.register_blueprint(inner_api_bp)
    app.register_blueprint(mcp_bp)

    tool = mcp_types.Tool(
        name=app_name,
        title=app_name if supports_structured else None,
        description=description,
        inputSchema=cast(dict[str, Any], parameter_schema),
        outputSchema={"type": "object"} if supports_structured else None,
    )
    return mcp_types.ListToolsResult(tools=[tool])

def handle_initialize(description: str, requested_version: str | int) -> mcp_types.InitializeResult:
    negotiated_version: str = mcp_types.SERVER_LATEST_PROTOCOL_VERSION
    if isinstance(requested_version, str) and requested_version in mcp_types.SERVER_SUPPORTED_PROTOCOL_VERSIONS:
        negotiated_version = requested_version
    capabilities = mcp_types.ServerCapabilities(
        tools=mcp_types.ToolsCapability(listChanged=False),
    )
    return mcp_types.InitializeResult(
        protocolVersion=negotiated_version,
        capabilities=capabilities,
        serverInfo=mcp_types.Implementation(name="Dify", version=dify_config.project.version),
        instructions=description,
    )

    @console_account_admission(allowed_roles=_EDIT_ROLES, rbac_checks=[RBACCheck(RBACPermission.APP_EDIT, PlainApp())])
    def post(self, request_context: RequestContext, app_id: UUID):
        payload = validate_request(MCPServerCreatePayload)

def start_authorization(
    server_url: str,
    metadata: OAuthMetadata | None,
    client_information: OAuthClientInformation,
    redirect_url: str,
    provider_id: str,
    tenant_id: str,
    scope: str | None = None,
) -> tuple[str, str]:

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

Skill rules 0 of 8 flagged

---
name: backend-code-review
description: Use only when the user explicitly requests a review or audit of backend code under `api/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, frontend code, or backend code outside `api/`.
---

# Backend Code Review

Review the requested scope for concrete, reproducible defects. The nearest `AGENTS.md` owns package facts and commands; this skill owns the review workflow and routes to its bundled rule packs.

## Evidence First

1. Establish the requested review scope and inspect the relevant diff or files.
2. Read the changed lines, their behavior owner, nearby tests, and local docstrings or comments that define contracts.
3. Trace callers, persistence boundaries, authorization, generated schemas, or external I/O only when they decide correctness.
…

## Severity And Output

- **P0**: security or privacy exposure, data loss, or a production-wide outage.
- **P1**: user-visible regression, broken authorization or tenant isolation, invalid public contract, or failed primary workflow.
- **P2**: concrete correctness, performance, maintainability, or test defect likely to cause incorrect behavior.
- **P3**: minor actionable cleanup; omit unless the user requested a thorough audit.

Lead with findings ordered by severity. Include a tight file and line reference, the failing contract or reproduction path, impact, and a concrete fix direction. If there are no findings, say `No issues found.` and state any material verification gap. Do not add praise sections, speculative risks, or an unsolicited offer to implement fixes.

description: Use only when the user explicitly requests a review or audit of backend code under `api/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, frontend code, or backend code outside `api/`.

(full file reviewed; plain markdown prose, no hidden/zero-width characters or concealed directives found)

---
name: backend-code-review
description: Use only when the user explicitly requests a review or audit of backend code under `api/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, frontend code, or backend code outside `api/`.
---

name: backend-code-review

## Evidence First

1. Establish the requested review scope and inspect the relevant diff or files.
2. Read the changed lines, their behavior owner, nearby tests, and local docstrings or comments that define contracts.
3. Trace callers, persistence boundaries, authorization, generated schemas, or external I/O only when they decide correctness.
4. Report only findings tied to an observable failure, violated contract, security boundary, data integrity risk, or demonstrated maintenance problem.

---
name: backend-code-review
description: Use only when the user explicitly requests a review or audit of backend code under `api/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, frontend code, or backend code outside `api/`.
---

# Backend Code Review

Review the requested scope for concrete, reproducible defects. The nearest `AGENTS.md` owns package facts and commands; this skill owns the review workflow and routes to its bundled rule packs.

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

Skill rules 0 of 8 flagged

---
name: e2e-cucumber-playwright
description: Use when writing, changing, or reviewing Cucumber and Playwright tests under `e2e/`, including feature files, step definitions, support code, scenario tags, locators, and assertions. Do not use for Vitest, React Testing Library, backend tests, or generic browser automation outside the E2E suite.
---

# E2E Cucumber And Playwright

`e2e/AGENTS.md` owns the suite architecture, lifecycle, commands, tags, generated-client boundaries, fixtures, and cleanup contracts.

## Workflow

1. Add E2E coverage only for a critical user journey with a cross-boundary outcome that cheaper owner-level tests do not already prove.
2. Identify the user-visible behavior and its feature owner. Start from real product defaults and actor roles; setup may establish preconditions but must not manufacture the opposite state to make the scenario meaningful.
3. Read the target scenario, matching step definitions, and lifecycle files only when session or shared state matters.
4. Reuse an existing step when wording and behavior match; add one coherent scenario or step when they do not.
5. Keep browser actions and assertions at the public user boundary; keep setup, seed, polling, and cleanup at their package-defined owners.
6. For changes, run the narrowest tagged scenario and package checks documented in `e2e/AGENTS.md`; broaden only for shared hooks, tags, or support changes.

For review requests, lead with reproducible correctness failures, flake sources, or demonstrated architecture drift. Report the behavior verified and any external-runtime, browser, or environment gap.

description: Use when writing, changing, or reviewing Cucumber and Playwright tests under `e2e/`, including feature files, step definitions, support code, scenario tags, locators, and assertions. Do not use for Vitest, React Testing Library, backend tests, or generic browser automation outside the E2E suite.

(full file reviewed; plain markdown prose, no hidden/zero-width characters or concealed directives found)

---
name: e2e-cucumber-playwright
description: Use when writing, changing, or reviewing Cucumber and Playwright tests under `e2e/`, including feature files, step definitions, support code, scenario tags, locators, and assertions. Do not use for Vitest, React Testing Library, backend tests, or generic browser automation outside the E2E suite.
---

name: e2e-cucumber-playwright

## Topic Routing

Read only the bundled reference required by the change:

- Locator, assertion, isolation, or waiting decisions: [`references/playwright-best-practices.md`][playwright]
- Scenario wording, step granularity, expressions, World state, hook visibility, or tag design: [`references/cucumber-best-practices.md`][cucumber]

Check current official Playwright or Cucumber documentation before introducing a framework pattern that local code and references do not already establish.

---
name: e2e-cucumber-playwright
description: Use when writing, changing, or reviewing Cucumber and Playwright tests under `e2e/`, including feature files, step definitions, support code, scenario tags, locators, and assertions. Do not use for Vitest, React Testing Library, backend tests, or generic browser automation outside the E2E suite.
---

# E2E Cucumber And Playwright

`e2e/AGENTS.md` owns the suite architecture, lifecycle, commands, tags, generated-client boundaries, fixtures, and cleanup contracts.

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

Skill rules 0 of 8 flagged

---
name: frontend-code-review
description: Use only when the user explicitly requests a review or audit of frontend code under `web/` or `packages/dify-ui/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, or backend-only code.
---

# Frontend Code Review

Review the requested scope for concrete defects and violations of explicit project contracts.

## Severity And Output

- **P0**: security or privacy leak, data loss, production crash, or inaccessible critical workflow.
...
Lead with findings ordered by severity. ... Do not add praise sections, speculative risks, or an unsolicited offer to implement fixes.

description: Use only when the user explicitly requests a review or audit of frontend code under `web/` or `packages/dify-ui/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, or backend-only code.

(full file reviewed; plain markdown prose, no hidden/zero-width characters or concealed directives found)

---
name: frontend-code-review
description: Use only when the user explicitly requests a review or audit of frontend code under `web/` or `packages/dify-ui/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, or backend-only code.
---

name: frontend-code-review

[Web Interface Guidelines]: https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md

# Frontend Code Review

Review the requested scope for concrete defects and violations of explicit project contracts. This skill owns review decisions; its references route to canonical rules without activating another skill's implementation workflow.

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

Skill rules 0 of 8 flagged

---
name: frontend-testing
description: Use when writing or changing Vitest or React Testing Library tests under `web/` or `packages/dify-ui/`, or when the user explicitly requests frontend test strategy, including evaluation of an existing strategy. Do not use for frontend code-review-only requests, general testability discussion, Python tests, or Cucumber/Playwright E2E.
---

# Frontend Testing

Read the testing policy for the package that owns the changed tests:

- `web/`: `web/docs/test.md` owns Web test boundaries, environments, and commands.
- `packages/dify-ui/`: `packages/dify-ui/docs/testing.md` owns primitive test boundaries, environments, Storybook, and commands.

This skill adds no parallel policy or check sequence. Follow the selected owner's requirements, including its validation commands. Recommend deleting low-value tests as readily as adding missing behavior coverage, and report the contract verified and any material verification gap.

description: Use when writing or changing Vitest or React Testing Library tests under `web/` or `packages/dify-ui/`, or when the user explicitly requests frontend test strategy, including evaluation of an existing strategy. Do not use for frontend code-review-only requests, general testability discussion, Python tests, or Cucumber/Playwright E2E.

(full file reviewed; plain markdown prose, no hidden/zero-width characters or concealed directives found)

---
name: frontend-testing
description: Use when writing or changing Vitest or React Testing Library tests under `web/` or `packages/dify-ui/`, or when the user explicitly requests frontend test strategy, including evaluation of an existing strategy. Do not use for frontend code-review-only requests, general testability discussion, Python tests, or Cucumber/Playwright E2E.
---

name: frontend-testing

# Frontend Testing

Read the testing policy for the package that owns the changed tests:

- `web/`: `web/docs/test.md` owns Web test boundaries, environments, and commands.
- `packages/dify-ui/`: `packages/dify-ui/docs/testing.md` owns primitive test boundaries, environments, Storybook, and commands.

This skill adds no parallel policy or check sequence. Follow the selected owner's requirements, including its validation commands. Recommend deleting low-value tests as readily as adding missing behavior coverage, and report the contract verified and any material verification gap.

# Frontend Testing

Read the testing policy for the package that owns the changed tests:

- `web/`: `web/docs/test.md` owns Web test boundaries, environments, and commands.
- `packages/dify-ui/`: `packages/dify-ui/docs/testing.md` owns primitive test boundaries, environments, Storybook, and commands.

This skill adds no parallel policy or check sequence.

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

Skill rules 0 of 8 flagged

---
name: how-to-write-component
description: Use when implementing or refactoring React/TypeScript components and the task requires decisions about component ownership, feature boundaries, state, data flow, effects, or interaction ownership. Do not use for review-only requests, test-only work, copy-only edits, or styling-only changes.
---

# How To Write A Component

Use this skill to route component architecture decisions to its bundled references. Read only the references required by the current change.

## Scope And Verification

Identify the behavior owner, state lifetime, and public contract from the nearby implementation and relevant references. Keep the change within that vertical slice unless the contract requires changes elsewhere. Verify the changed behavior and complete the owning package's required checks.

description: Use when implementing or refactoring React/TypeScript components and the task requires decisions about component ownership, feature boundaries, state, data flow, effects, or interaction ownership. Do not use for review-only requests, test-only work, copy-only edits, or styling-only changes.

(full file reviewed; plain markdown prose, no hidden/zero-width characters or concealed directives found)

---
name: how-to-write-component
description: Use when implementing or refactoring React/TypeScript components and the task requires decisions about component ownership, feature boundaries, state, data flow, effects, or interaction ownership. Do not use for review-only requests, test-only work, copy-only edits, or styling-only changes.
---

name: how-to-write-component

## Topic Routing

- Component moves, module boundaries, props, types, or owner placement: read [`references/ownership.md`][ownership].
- Dify UI wrappers or primitive state styling: read the package's [Public API authoring] and [Styling] contracts.
- Jotai, form drafts, route identity, URL state, or persistence: read [`references/state.md`][state].
- Generated contracts, nullable API data, Query, mutations, SSR, auth, or workspace state: read [`references/data.md`][data].
- Hotkeys, focus, dialogs, menus, popovers, or other secondary surfaces: read [`references/interactions.md`][interactions] and the overlay guide it references when applicable. Also read [`references/state.md`][state] when the surface owns a draft or other local session state.
- Effects, navigation, memoization, preloading, or render cost: read [`references/runtime.md`][runtime].

# How To Write A Component

Use this skill to route component architecture decisions to its bundled references. Read only the references required by the current change.

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

Skill rules 0 of 8 flagged

---
name: e2e-summary-skill
description: Summarize user input for Agent Builder E2E coverage.
---

# e2e-summary-skill

Summarize the user input in one concise paragraph.

The summary must include E2E_SUMMARY_SKILL_PASS.

# e2e-summary-skill

Summarize the user input in one concise paragraph.

The summary must include E2E_SUMMARY_SKILL_PASS.

description: Summarize user input for Agent Builder E2E coverage.

# e2e-summary-skill

Summarize the user input in one concise paragraph.

The summary must include E2E_SUMMARY_SKILL_PASS.

---
name: e2e-summary-skill
description: Summarize user input for Agent Builder E2E coverage.
---

name: e2e-summary-skill

# e2e-summary-skill

Summarize the user input in one concise paragraph.

The summary must include E2E_SUMMARY_SKILL_PASS.

# e2e-summary-skill

Summarize the user input in one concise paragraph.

The summary must include E2E_SUMMARY_SKILL_PASS.

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.

What stood out

• Known CVEs in pinned dependency versions, notably chromadb==0.5.20 (CVE-2026-45833 CRITICAL, plus two HIGH CVEs) with no fix currently available, and additional HIGH CVEs in pydantic-ai-slim, golang.org/x/mod, and socket.io-parser (ATR-C0007, HIGH).
• Hardcoded default secrets shipped in docker-compose.yaml/docker-compose-template.yaml (PLUGIN_DAEMON_KEY, PLUGIN_DIFY_INNER_API_KEY, DIFY_AGENT_SERVER_SECRET_KEY, MINIO_SECRET_KEY) take effect on any deployment that does not override them, giving a publicly-known static credential for internal plugin-daemon/inner-API/object-storage channels (ATR-C0002, HIGH).
• Dify's app-as-MCP-server feature (api/controllers/mcp/mcp.py, api/core/mcp/server/streamable_http.py) exposes a remote streamable-HTTP MCP endpoint gated solely by a 16-char CSPRNG 'server_code' embedded in the URL path -- there is no standard Authorization/Bearer check, no OAuth 2.1/PKCE flow, and no rate limiting on the server_code lookup, making it a bearer-URL style credential with brute-force risk and typical URL-secret leakage via proxy/access logs and Referer headers.
• The mcp Flask blueprint is the only blueprint registered in extensions/ext_blueprints.py with NO CORS/Origin policy applied, leaving no Origin/Host validation in front of a host-side-effectful endpoint that invokes full Dify app generation.
• A password-reset / sensitive auth token is logged in full at WARNING level in api/libs/helper.py TokenManager.get_token_data, exposing a usable account-takeover credential to anyone with log access (ATR-C0005, MEDIUM).
• The reference deployment ships insecure-by-default transport settings: the API container's gunicorn process binds 0.0.0.0 with no TLS, and NGINX_HTTPS_ENABLED defaults to false in docker/docker-compose.yaml / docker/.env.example, making TLS opt-in rather than mandatory.
• Insecure deserialization (pickle) used for the RAG embedding cache column; the stored BLOB has no integrity binding, so any future write primitive against that column becomes an RCE vector (ATR-C0009).
• Auxiliary/dev container images (docker/couchbase-server/Dockerfile, .devcontainer/Dockerfile) run as root and/or use a floating ':latest' base tag, unlike the hardened production api/Dockerfile and web/Dockerfile (ATR-C0006, MEDIUM).
• Tool-output-to-LLM-context sanitization (ATR-C0013) could not be fully verified across the plugin-daemon boundary; the agent scratchpad/Observation concatenation path and plugin-daemon tool-result boundary lack confirmed control-character/injection-marker stripping.
• skills/difyctl destructive operations (remove/revoke) have no enforced confirmation prompt, relying on the model volunteering confirmation rather than enforcing it in the agent harness.

Skill rules 0 of 8 flagged

---
name: difyctl
description: 'Base skill for the difyctl CLI: find any command or Dify operation through help and run it as a command. Use when the task involves difyctl or a Dify server from the command line.'
---

# difyctl

difyctl talks to a Dify server. Business commands are not built in: the server publishes a catalog of operations, and each one is a command you discover at run time.

Always pass `--json`. Help and errors are text on a terminal and JSON in a pipe; `--json` (or `DIFY_OUTPUT=json`) forces JSON. Results and streams are always JSON.

## Destructive operations

Operations that remove or revoke have no confirmation prompt. Confirm with the person first.

`difyctl login --server https://...` (device flow; `--no-browser` prints the URL and code; `--no-keyring` keeps the token in a file; `--insecure` skips TLS verification). One login at a time. `difyctl use workspace <id>` pins a workspace; `difyctl get workspace` shows them. Scripts skip login with `DIFY_SERVER` and `DIFY_TOKEN`; `DIFY_WORKSPACE_ID` overrides the pin; `DIFY_CONFIG_DIR` and `DIFY_CACHE_DIR` move the files.

description: 'Base skill for the difyctl CLI: find any command or Dify operation through help and run it as a command. Use when the task involves difyctl or a Dify server from the command line.'

(full file reviewed; plain markdown prose, no hidden/zero-width characters or concealed directives found)

## Other skills

Scenario skills add guidance for one kind of task. `difyctl get skills` shows them; `difyctl install skills <skills root> --skill <name>` installs one, where `<skills root>` is the folder above this file's folder. Re-running `difyctl install skills <skills root>` after upgrading difyctl refreshes every skill.

---
name: difyctl
description: 'Base skill for the difyctl CLI: find any command or Dify operation through help and run it as a command. Use when the task involves difyctl or a Dify server from the command line.'
---

`difyctl login --server https://...` (device flow; `--no-browser` prints the URL and code; `--no-keyring` keeps the token in a file; `--insecure` skips TLS verification). ... `DIFY_CONFIG_DIR` and `DIFY_CACHE_DIR` move the files.

`login` blocks until the browser approval arrives. Run `difyctl login --server <url> --no-browser` as a background job, relay the `open <url>` and `code <code>` lines from its stderr to the user, and do not cancel the job.

Before you put it to work

1. Upgrade or disable the chromadb vector-store provider pending a fix for CVE-2026-45833/45830/45831; upgrade pydantic-ai-slim, golang.org/x/mod, and socket.io-parser to patched versions.
2. Remove hardcoded fallback secret values from docker-compose*.yaml; fail-fast or auto-generate random secrets on first run instead.
3. Add OAuth 2.1 (with PKCE) as the primary authorization mechanism for the inbound MCP server endpoint, or at minimum require a standard Authorization header bearer token in addition to server_code, plus rate limiting/lockout on failed server_code lookups.
4. Apply an explicit CORS/Origin allowlist (or host-based validation) to the mcp Flask blueprint consistent with the other blueprints in extensions/ext_blueprints.py.
5. Stop logging raw token values in api/libs/helper.py TokenManager.get_token_data; log only a hash/prefix or the Redis key.
6. Make TLS mandatory (NGINX_HTTPS_ENABLED default true) for any deployment exposing MCP/API endpoints beyond localhost, and default DIFY_BIND_ADDRESS to loopback for standalone (non-compose) runs.
7. Replace pickle-based embedding serialization with a safe format (numpy tobytes/JSON) as defense-in-depth against any future write-path compromise.
8. Add non-root USER directives and pin a specific (non-'latest') base image tag for docker/couchbase-server/Dockerfile and .devcontainer/Dockerfile; add HEALTHCHECK to all shipped Dockerfiles.
9. Conduct a focused audit of the tool-output-to-context concatenation path (agent scratchpad Observation field) and the plugin-daemon boundary for control-character/prompt-injection-marker sanitization.
10. Harden skills/difyctl's destructive-operation guidance into an enforced confirmation gate in the surrounding agent harness.