Security audit

代码生成器

Security checks for vulnerabilities and agentic risk

Overview

This code-generation skill is coherent, but it needs Review because its sample generator can write outside the intended project folder and can generate unsafe Python code from unvalidated names.

Review this skill before installing. Use it only with trusted templates and explicit output directories, inspect generated files before running them, and avoid untrusted API handler names or HTTP method values until path containment and identifier/string validation are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:52
Finding: Arbitrary File Write Through Unvalidated Template Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:160
Finding: Python Source Injection in Generated API Handlers
Content: View full analysis
str: """生成API handler代码""" method_handlers = "\n\n".join([ f"async def {m.lower()}_{name}(request):\n \"\"\"{m} /api/{name}\"\"\"\n return {{'method': '{m}', 'handler': '{name}'}}" for m in methods ]) return f""" from typing import Dict, Any # Auto-generated API handler: {name} {method_handlers} def register_routes(app): \"\"\"Register all routes for {name}\"\"\" pass """ ``` ### Technical Analysis The `name` and `methods` arguments are interpolated directly into multiple Python syntactic contexts: - Function identifiers - Triple-quoted docstrings - Single-quoted string literals - A generated source-code comment No identifier validation or string escaping is performed. Characters such as quotes, backslashes, newlines, parentheses, and comment markers can therefore alter or terminate the intended syntax. At minimum, untrusted values can corrupt the generated module and cause a denial of service. Carefully coordinated values can inject additional Python statements into the generated source. This method only returns source text, so injection does not execute during generation itself. Code execution requires the generated handler module to be saved and subsequently imported or run. ### Attack Path 1. An attacker gains influence over the handler `name`, one or more entries in `methods`, or both. 2. The attacker provides values containing Python syntax delimiters, line breaks, or statement text. 3. `generate_api_handler()` embeds those values verbatim into identifiers, docstrings, and string literals. 4. The application writes the returned text into a Python source file. 5. A developer, build process, test runner, or deploy ...[truncated 869 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation phrase is very broad ('生成代码 / code generate / 项目脚手架'), which can cause the skill to trigger in contexts where the user did not clearly intend file-generating behavior. Because this skill can create directories and write multiple files, ambiguous invocation increases the risk of unintended scaffold generation or workspace modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises automatic directory creation and file generation but does not clearly warn users that it will write to disk. In this context, the Python implementation calls os.makedirs(...) and writes files via open(..., 'w'), so omission of a warning meaningfully increases the chance of unexpected filesystem changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill description is written in Chinese and presents the capability in that locale without stating whether users may interact in another language. This can conflict with language-choice policies when no opt-in or locale justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.