InspirAI Best Practices

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:05 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent best-practice note manager, but it needs review because it persists local content and performs file copy/delete operations without clear path containment safeguards.

Review this skill before installing. It is not trying to steal data or install a backdoor, but it can create, update, copy, and delete local Markdown files. Use it only with trusted entries, confirm exact paths before copy/delete actions, and prefer adding slug/category validation plus canonical path checks before relying on it.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:108

Finding

Unsanitized Path Components Permit Filesystem Traversal

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108–128, 239–265, 448–449, and 544–548
Vulnerability Type: Path traversal and unsafe shell path handling
Risk Level: Medium

Vulnerable Code

bash

CATEGORY="wechat"
SLUG="scan-login"
ID="${CATEGORY}-${SLUG}"
FILE_PATH="$BP_DIR/$CATEGORY/$SLUG.md"
DATE=$(date +%Y-%m-%d)

mkdir -p "$BP_DIR/$CATEGORY"

The generated path is subsequently used by read, copy, and delete operations:

bash

FILE_PATH="$BP_DIR/{category}/{slug}.md"
cat "$FILE_PATH"

bash

mkdir -p docs/references
cp "$FILE_PATH" "docs/references/{id}.md"
echo "Copied to docs/references/{id}.md"

bash

FILE_PATH="$BP_DIR/{category}/{slug}.md"
cat "$FILE_PATH"

bash

rm "$BP_DIR/{category}/{slug}.md"

if [ -z "$(ls -A $BP_DIR/{category})" ]; then
    rmdir "$BP_DIR/{category}"
fi

Technical Analysis

The Skill constructs filesystem paths from category, slug, ID, and index-derived values without specifying validation requirements or verifying that the canonical destination remains within $HOME/.inspirai/best-practices/.

If an attacker can influence a category, slug, ID, or index.json file entry, traversal sequences such as ../ may cause the resulting path to resolve outside the intended data directory. Absolute paths, control characters, leading hyphens, whitespace, wildcard characters, and other shell-significant input are likewise not explicitly rejected.

Most shown variable expansions are quoted, which limits direct shell command injection. However, this does not prevent path traversal. In addition, the following expansion is unquoted:

bash

ls -A $BP_DIR/{category}

This permits shell word splitting and pathname expansion if the substituted category contains whitespace or glob characters.

Attack Path

1. An attacker supplies a malicious category or slug during capture, or modifies an entry in t ...[truncated 1383 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply a strict allowlist to categories, slugs, and IDs, such as:

   text

   ^[a-z0-9][a-z0-9-]{0,63}$
   

2. Reject values containing path separators, .., absolute-path syntax, null bytes, control characters, whitespace, wildcard characters, or leading hyphens.

3. Do not trust the file property in index.json. Reconstruct paths only from independently validated identifiers.

4. Resolve every target to a canonical absolute path and verify that it remains below the canonical $BP_DIR path before reading, writing, copying, or deleting it.

5. Quote every shell variable expansion, including the directory passed to ls.

6. Add -- before path operands where supported:

   bash

   cat -- "$FILE_PATH"
   cp -- "$FILE_PATH" "$DESTINATION"
   rm -- "$FILE_PATH"
   rmdir -- "$CATEGORY_DIR"
   

7. Refuse deletion when the resolved path is equal to $BP_DIR, $HOME, the project root, or any other protected directory.

8. Prefer structured filesystem APIs over interpolated shell commands.

9. Add tests covering traversal strings, absolute paths, whitespace, wildcard characters, symbolic links, and malicious index entries.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:83

Finding

Persistent Best-Practice Content Can Poison Future Agent Actions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 83–105, 132–167, and 239–260
Vulnerability Type: Persistent untrusted-instruction handling
Risk Level: Medium

Vulnerable Instruction Segment

The capture workflow requests arbitrary solution steps and code content for persistent storage:

text

Problem description:
Briefly describe the problem scenario.

Solution:
Describe the key steps of the solution.

Key code:
Paste the key code snippet.

The content is stored in a persistent Markdown document:

markdown

---
id: {id}
title: {title}
category: {category}
tags: [{tags}]
created: {date}
updated: {date}
---

## Problem

{problem}

## Solution

{solution}

## Key Code

{code}

## Notes

{notes}

## Related Links

{links}

The apply workflow later reads the complete stored document and offers to act on it:

bash

FILE_PATH="$BP_DIR/{category}/{slug}.md"
cat "$FILE_PATH"

text

The loaded document is displayed in full.

Available action:
- Directly start implementation according to the solution steps.

When direct implementation is selected:
- Display the solution steps.
- Guide the user through implementation step by step.

Technical Analysis

The Skill intentionally persists user-authored problem descriptions, solution steps, code, notes, and links across sessions. It later loads that content in full and directs the Agent to guide implementation based on the stored solution.

The instructions do not establish a trust boundary between stored reference data and executable Agent instructions. They do not require the Agent to ignore embedded role directives, tool-call requests, safety-constraint overrides, or commands unrelated to the selected best practice. They also do not require renewed approval before executing destructive, network-sensitive, credential-related, or package-installation steps found in stored conte ...[truncated 1692 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly classify all loaded best-practice documents as untrusted reference data.
2. Instruct the Agent never to treat embedded system prompts, role changes, safety overrides, tool directives, or unrelated commands as authoritative instructions.
3. Parse and display stored content before proposing any implementation action.
4. Generate a separate action plan derived from the document and require explicit user confirmation before execution.
5. Require per-operation approval for:
   • Destructive filesystem changes.
   • Commands outside the current project.
   • Network requests.
   • Credential or secret access.
   • Package installation.
   • Permission changes.
   • Execution of downloaded or encoded content.
6. Validate every proposed path and command independently rather than trusting stored snippets.
7. Warn users when an entry was created or modified by another party or when its integrity cannot be verified.
8. Consider signing entries or recording trusted provenance and hashes.
9. Provide a safe view-only mode that never invokes tools based on document content.
10. Add prompt-injection tests containing embedded role directives, tool requests, data-exfiltration instructions, and attempts to override confirmation requirements.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The delete flow uses rm on a path assembled from category and slug placeholders without specifying strong validation or safe path canonicalization. If an attacker can influence the stored index or ID-to-path mapping, path traversal or unexpected path resolution could delete arbitrary files under the user's permissions; this is especially dangerous because the skill already maintains attacker-influenced persistent metadata and supports destructive operations.

Content

Scanner excerpt · SKILL.md (reported line 544)May include surrounding context.

bash

# 删除文档文件
rm "$BP_DIR/{category}/{slug}.md"

# 检查分类目录是否为空，为空则删除
if [ -z "$(ls -A $BP_DIR/{category})" ]; then

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description presents the skill as simple best-practice management but omits that it supports update and delete lifecycle actions and can copy files into a project. This can mislead users or calling systems about the skill's actual write and destructive capabilities, reducing informed consent and increasing the chance of unsafe invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains broad phrases like '最佳实践', 'best practice', '解决方案', and '经验记录', which are common in normal conversation and likely to cause unintended activation. Because the skill can write, copy, update, and delete files, accidental invocation creates a real integrity risk rather than a harmless UX issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill's title, descriptions, prompts, and user interaction text are all written as mandatory Chinese output, and there is no indication that the user may choose another language. Under the policy, language constraints should be opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill stores data under $HOME/.inspirai/best-practices/ and creates and modifies files there, but it does not provide a clear user-facing warning that home-directory content will be written persistently. Silent persistence in a hidden home subdirectory can surprise users and may expose sensitive notes or code snippets to later unintended reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The '复制到项目文档' flow copies content directly into docs/references/{id}.md without an explicit warning that project contents will be modified. Because best-practice entries may contain arbitrary user-supplied text or code, this can introduce unreviewed content into a repository and affect source control, documentation integrity, or downstream automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.