T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:273- Finding
Arbitrary File Overwrite Through Unrestricted Output Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Lay Press Release Writer
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a straightforward press-release generator, but it can overwrite any writable local file through an unrestricted output path.
Review before installing. Use this only in a sandbox or workspace where overwriting files is acceptable, and avoid passing untrusted or absolute paths to --output until the script restricts output to a safe directory and refuses accidental overwrites.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises an executable Python entry point and explicitly describes writing generated output files, but it does not declare any tool/permission scope such as allowed file-write locations. That creates an authorization gap: an agent may invoke the skill with broader filesystem privileges than intended, increasing the risk of unintended or unsafe writes if the script or its inputs are manipulated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation guidance is broad and repetitive ('use this skill when...') without sharp trigger boundaries, so an orchestrating agent could select it for loosely related academic writing tasks outside its validated purpose. Overbroad routing increases the chance that the packaged script is run on unsuitable inputs or in contexts with different sensitivity, causing unsafe file handling, disclosure, or incorrect automated outputs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The label "Use this skill for academic writing tasks that require explicit assumptions, bounded scope, and a reproducible output format" is broader than the stated purpose of converting academic papers into lay university press releases. In agentic systems, broad invocation wording can cause the skill to be selected for out-of-scope academic-writing tasks, increasing the chance of inappropriate transformation, weak boundary enforcement, or misleading outputs beyond the skill’s tested guarantees.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function generate_body accepts a target_audience argument and the CLI documents audience selection, implying the press release will be adapted for general, alumni, or media readers. In practice, the parameter is never used in body generation or elsewhere, so the documented intent contradicts the actual behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The generated media contact always uses a .edu.cn email address and a China-specific switchboard workflow, which imposes a specific regional/locale assumption in the skill's output. Because the file does not document that the skill is China-only or offer a locale choice, this is a natural-language locale policy issue.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI exposes a --tone option with multiple style choices, signaling that users can control writing style. However, no downstream code reads or applies args.tone, so the documented capability is not implemented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The example centers on a specific institution and Chinese personal names, while the skill does not state whether output language or locale should follow user preference. Because the skill produces public-facing press releases, failing to specify language choice can implicitly bias outputs toward an assumed locale without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The comment on L4 is written only in Chinese ('无外部依赖，仅使用Python标准库'), which may indicate a language-specific expectation without offering user choice or documenting a justified locale constraint. The policy requires flagging language or locale constraints when they are imposed without opt-in.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest frames the skill as a content transformation tool, but the code also persists results to an arbitrary file path via the --output option. While outputting generated content is related to the core function, writing to disk goes beyond a purely in-memory transform described in the manifest.
- Content
Static analysis
No suspicious patterns detected.