T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:61- Finding
Hardcoded Feishu Application Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Prd Review
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent PRD review tool, but it needs Review because it ships a plaintext Feishu app secret and automatically keeps sensitive review history.
Install only after the Feishu secret has been removed and rotated. Treat prior copies as exposed. Before use, require user-scoped Feishu authorization, make write-back explicitly confirmed, and make audit-history storage opt-in with clear retention and deletion controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
SKILL.md:697- Finding
Automatic Persistent Retention of Sensitive PRD Audit Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger surface is overly broad, using generic words like 'review' and 'check' that commonly appear in unrelated conversations. This can cause the skill to activate on unintended inputs and process or exfiltrate content that the user did not mean to send through this PRD-review workflow.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The When-to-Use section authorizes activation on generic audit/check language without sufficiently constraining scope to PRD documents. In context, this is more dangerous because activation can lead to external document access and persistent storage, magnifying the impact of false triggering.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill reads Feishu documents via an external integration and includes credential-like parameters, but it does not clearly warn users that content will be transmitted to an external service. This creates a consent and data-handling risk because sensitive internal PRDs may be fetched and processed outside the user's expectations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill embeds fixed Feishu app credentials/secrets directly in the skill content. Hardcoded secrets are dangerous because anyone with access to the skill can reuse them to access Feishu resources, and the credentials cannot be safely rotated or scoped per user session.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The embedded command configuration sets the integration locale to
-l', 'zh', which indicates a fixed Chinese language/locale setting. The file does not offer users a language choice or explain that this locale restriction is required, so it constitutes a natural-language locale policy concern.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's stated purpose is PRD review, but the documented behavior also includes creating Feishu documents and writing outputs beyond transient analysis. This is risky because it expands the skill from read/analyze into persistence and external side effects, which users may not expect from the description and can cause unintended disclosure or propagation of sensitive review content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill can write audit reports back into Feishu, but the user-facing flow does not clearly warn about this outbound action. Unannounced write-back can leak sensitive findings to the wrong workspace or create records that users did not intend to publish.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill persists audit-history JSON files containing document titles, metadata, issue summaries, and review outcomes, but this retention is not disclosed in the skill description. Hidden persistence of potentially sensitive business-review data creates privacy, compliance, and data-minimization risks, especially for internal product documents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill stores audit results locally in a history directory without a clear user warning about retention of document metadata and findings. Even if full source text is not always stored, the retained titles, issue summaries, scores, and history can reveal confidential roadmap and product-quality information over time.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs persistent retention of prior audit artifacts and user-derived review data in an audit-history directory. Persistent storage of sensitive internal-review metadata increases exposure in case of host compromise, over-retention, unauthorized reuse, or later correlation of project history.
- Content
Static analysis
No suspicious patterns detected.