T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:17- Finding
Undisclosed Transmission of Sensitive User Documents to a Third-Party API
- Content
View full analysis
- Remediation
View remediation
Security audit
Short Video Script Creator
Security checks for vulnerabilities and agentic risk
Overview
This script-writing skill has a real confidentiality risk because it can read user documents, print them to logs, and send them to a hard-coded third-party model API with an embedded API key.
Review this skill carefully before installing. Do not use it with confidential customer, strategy, meeting, product, or competitor documents unless you are comfortable with the full contents being logged locally, saved under the skill output directory, and potentially sent to the hard-coded external model service. The embedded API key should be treated as compromised and replaced with user-managed credentials before use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:18- Finding
Hard-Coded API Credential Exposed in Source Code
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:121- Finding
Complete Sensitive Prompt Contents Printed to Standard Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:147- Finding
Documented User-Confirmation Security Gate Is Not Enforced
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This is a serious description-behavior mismatch: the skill is presented as a script-writing tool, but the detected behavior includes sending user inputs and document contents to a third-party model API, using undeclared remote network access, hardcoded credentials, and writing prompts/results to a fixed local directory. In this context, the skill processes potentially sensitive business documents such as product files, strategy maps, and historical scripts, so silent exfiltration and unsafe secret handling materially increase confidentiality and operational risk.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md 好的，任务收到。作为顶级的IP文案策划师，我将立即进入“小麦”的角色，根据你提供的全部信息，进行纯粹的原创。 **【口吻分析与提炼】**
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises file and model-driven behavior but declares no tool scope or permissions, while the analyzed capability set indicates file read, file write, and network access. That combination is dangerous because users are not given an explicit trust boundary: local documents may be read, prompt/result data may be written to disk, and content may be sent off-host without transparent authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description, usage guidance, and embedded prompt template are entirely written in Chinese and assume Chinese output conventions, but the file does not state that the skill is intentionally limited to Chinese users or offer any language/locale opt-in. This creates a natural-language policy issue because the skill effectively enforces a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instructions define the skill entirely in Chinese and direct the model to produce final output in that language and format, with no indication that the user can choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file begins with Chinese-only natural-language instructions and states the assistant will immediately enter the role and respond in that style, with no indication that another language is available on request. This creates a language/locale policy concern because the skill appears to impose a specific language without user opt-in or a documented regional justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill reads potentially sensitive local files such as meeting notes, product documents, competitor scripts, and historical copy, then packages that content into prompts sent to an external model API. In a content-generation skill, this is dangerous because it can exfiltrate confidential business information beyond what users may reasonably expect from the description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The model API request sends file-derived user content to a remote endpoint without any in-code warning, consent flow, or disclosure. Because the skill is specifically designed to ingest internal business materials, silent transmission to a third party raises significant confidentiality and compliance risks.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code prints the full replacements dictionary, which includes raw contents extracted from user-supplied files and prompt fields. This can leak sensitive business data into terminal logs, CI logs, shell history captures, or host monitoring systems even if the model call is never made.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The package description is written entirely in Chinese and presents the skill's behavior in that locale without any indication that users can choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file contains user-facing descriptions, comments, and error/help text in Chinese, and the CLI experience appears fixed to that language. There is no indication that the user can opt into another language or locale, which may violate a language-choice policy.
- Content