T09 · Insecure Skill Coding Practices
Warning
- Location
specializations/ml-system.md:60- Finding
ML health endpoint guidance exposes sensitive infrastructure state
- Content
View full analysis
- Remediation
View remediation
Security audit
Software Architecture Design SOP
Security checks for vulnerabilities and agentic risk
Overview
This is a markdown-only architecture-design SOP skill with no executable code or hidden system access, though users should review one ML health-endpoint recommendation before adopting generated designs.
Install is reasonable for architecture-document generation. Before using its ML/AI output in production, change detailed health/resource reporting to an authenticated internal metrics endpoint and keep public liveness checks minimal. Also expect the default output template to be Chinese unless you explicitly ask the agent for another language.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises very broad activation phrases such as architecture design, system design, technical design, and equivalent Chinese terms, which can cause it to trigger on many generic design-assistance requests. Over-broad routing can inappropriately steer unrelated conversations into this skill, increasing prompt-surface exposure and creating opportunities for unintended file-loading or instruction interference from skill content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions say to paste the file into any AI and then say '请按照上面的 SOP 帮我做架构设计', which is a very general request for architecture design rather than a narrowly scoped trigger. The document does not provide exclusion conditions, negative examples, or constraints clarifying when this SOP should or should not be used.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template content is written as a fixed Chinese architecture document format, including the title and section/table labels, with no indication that the user can choose another language. This is a natural-language policy concern because it imposes a specific locale by default rather than offering opt-in or documenting a justified region-specific requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The usage instructions are presented only in Chinese and direct the user to use a fixed Chinese invocation phrase. There is no indication that other languages are supported or that the user may choose their preferred language, which can conflict with language/locale choice expectations.
- Content
Static analysis
No suspicious patterns detected.