T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:85- Finding
Untrusted Code Execution Workflow Relies on Non-Enforced Sandbox Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Code Sandbox
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent, but it should be reviewed because it promises safe execution of untrusted code without providing an enforceable sandbox.
Use this only with a real, independently enforced sandbox such as a fresh container or microVM with no network, restricted mounts, low privileges, and hard resource limits. Do not rely on the markdown blacklist or sample configuration as a security boundary, and require explicit user confirmation before running any untrusted code.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md '/var', '*.key', '*.pem', '.env', ], 'max_file_size': 10 * 1024 * 1024, # 10MB }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md '/var', '*.key', '*.pem', '.env', ], 'max_file_size': 10 * 1024 * 1024, # 10MB }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python def dangerous_code(): import os os.system('rm -rf /') # ❌ 拦截! # 错误: 检测到危险操作 "rm -rf /" # 建议: 这是破坏性操作，禁止执行
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python def dangerous_code(): import os os.system('rm -rf /') # ❌ 拦截! # 错误: 检测到危险操作 "rm -rf /" # 建议: 这是破坏性操作，禁止执行
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python def dangerous_code(): import os os.system('rm -rf /') # ❌ 拦截! # 错误: 检测到危险操作 "rm -rf /" # 建议: 这是破坏性操作，禁止执行
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python def dangerous_code(): import os os.system('rm -rf /') # ❌ 拦截! # 错误: 检测到危险操作 "rm -rf /" # 建议: 这是破坏性操作，禁止执行
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
import os os.system('rm -rf /') # ❌ 拦截!
错误: 检测到危险操作 "rm -rf /"
建议: 这是破坏性操作，禁止执行
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md SANDBOX_REJECT = { 'status': 'rejected', 'reason': 'dangerous_pattern', 'pattern': 'rm -rf /', 'line': 5, 'suggestion': '删除根目录是破坏性操作', }
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The primary description is written entirely in Chinese and the document consistently presents the skill behavior in Chinese without indicating that language is optional or user-selectable. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown declares activation phrases as "安全执行 / 沙箱运行 / 验证代码", but it does not specify when these phrases should or should not invoke the skill. Terms like "验证代码" are broad enough to overlap with ordinary requests for code review or validation, which can cause unintended activation without negative examples or tighter constraints.
- Content
Static analysis
No suspicious patterns detected.