T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:38- Finding
Hardcoded Token Exposed in an Untrusted External Subscription Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai安全 B9b1fb
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a Markdown guide, but it repeatedly embeds an unrelated token-bearing external endpoint and broad triggers, so users should review it carefully before installing.
Install only after removing or validating the repeated endpoint and token-like value, narrowing the triggers to the actual AI-security learning topic, and confirming the merged sections are intentional. The artifact does not show automatic execution or persistence, but the unexplained external subscription URL is not appropriate for a general guide.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The single-word trigger "xn" is extremely vague and is likely to collide with unrelated text, abbreviations, or tokens. In a skill already containing suspicious URL and token content, such a broad trigger can lead to accidental activation and propagation of untrusted endpoint data into unrelated interactions.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This repeated trigger block again uses the single-word activation "xn," compounding the accidental invocation risk across duplicated sections. Duplication makes the unsafe trigger harder to audit and increases the chance that at least one copy survives future edits or automated merges.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Another duplicated section retains the ambiguous "xn" trigger, showing that unsafe activation logic has propagated through merges. Repetition increases operational risk because multiple blocks may be parsed differently by tooling, making unintended activation more likely.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The final repeated occurrence of the "xn" trigger confirms a pattern of unsafe, overly generic invocation criteria embedded throughout the file. Given the surrounding endpoint-centric content, this creates a realistic pathway for broad accidental activation and exposure of suspicious external references.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents itself as an AI-security learning guide, but later merged sections redefine the skill around a subscribe endpoint and token-like artifacts. This semantic mismatch is dangerous because it can mislead users or agents into trusting and surfacing unrelated external indicators, URLs, or secrets under the guise of benign educational content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions include broad phrases like general AI-security help requests, which can cause the skill to activate in many unrelated contexts. Because the skill content contains suspicious merged endpoint and token material, overbroad triggering raises the chance that untrusted or irrelevant content is injected into normal conversations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section stores and promotes a subscription API URL with a token-like query parameter inside a skill advertised as an AI-security learning resource. Embedding such artifacts can expose credentials, trigger unsafe agent behavior, or repurpose the skill into a delivery mechanism for untrusted external infrastructure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Repeated subsections for the same skill name overwrite the original educational framing with a concrete subscribe endpoint, making the skill's effective behavior and intent ambiguous. This increases the chance that downstream systems index, trigger, or summarize the maliciously or accidentally injected endpoint content instead of the declared topic.
- Content