T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/audit_skills.py:69- Finding
Unescaped Skill Metadata Allows Markdown Report Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Skills Audit
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its audit purpose, but it includes under-scoped instructions for irreversible deletion of installed skill folders.
Review this skill before installing if you expect it to perform cleanup. Use it only for report generation unless you manually verify exact absolute paths first; prefer moving candidate skills to a quarantine folder instead of running the documented rm -rf command.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/audit_skills.py:175- Finding
Predictable Report Destination Permits Symbolic-Link File Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code substantially matches the core declared purpose of auditing installed skills, scanning SKILL.md files, comparing against a golden list, classifying skills, and generating a report. However, the declared description explicitly says it identifies duplicates, but the implementation never computes duplicates:
duplicate_groupsis initialized and never used, and no duplicate analysis appears in the report. That is a material behavior gap because duplicate detection is presented as a key use case and output. Additionally, platform-specific classification is implemented via regex searches over skill file content, not by comparing against a golden approved/platform list as the description suggests. This second issue is smaller, but it contributes to a mismatch between declared and actual methodology. No unrelated or risky undeclared capability is present beyond writing the report file.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This is a true positive because the skill explicitly recommends a high-risk destructive shell command against a user-supplied directory token. The surrounding context only partially reduces risk because 'after user confirmation' is not sufficient protection against path confusion, injection-like substitution mistakes, or operational error.
- Content
4. Remove redundant skills (after user confirmation)
bash rm -rf ~/.workbuddy/skills/<skill-dir>Classification Rules
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This is a true positive because the skill explicitly recommends a high-risk destructive shell command against a user-supplied directory token. The surrounding context only partially reduces risk because 'after user confirmation' is not sufficient protection against path confusion, injection-like substitution mistakes, or operational error.
- Content
4. Remove redundant skills (after user confirmation)
bash rm -rf ~/.workbuddy/skills/<skill-dir>Classification Rules
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This is a true positive because the skill explicitly recommends a high-risk destructive shell command against a user-supplied directory token. The surrounding context only partially reduces risk because 'after user confirmation' is not sufficient protection against path confusion, injection-like substitution mistakes, or operational error.
- Content
4. Remove redundant skills (after user confirmation)
bash rm -rf ~/.workbuddy/skills/<skill-dir>Classification Rules
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to read from the filesystem and generate a report, and also includes a deletion step, yet it declares no explicit tool scope or permissions. That gap weakens least-privilege controls and makes it easier for an agent runtime to grant broader file access than the skill actually needs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents an irreversible rm -rf deletion workflow without a prominent safety warning, validation steps, or safer alternatives. In an agent context, terse destructive instructions can normalize unsafe execution and increase the chance of accidental data loss if the target path is wrong or attacker-influenced.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says the skill audits installed skills to identify duplicates, platform-mismatched skills, and maintenance candidates. In the implementation, report generation only classifies skills as approved, unknown, or platform-specific and never computes or reports duplicate skills, despite even initializing an unused duplicate_groups variable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This reference file presents most skill names in English but includes one built-in skill name in Chinese, with no note explaining the locale choice or offering language flexibility. That can create a language/locale policy inconsistency for users or auditors who expect a single language unless explicitly documented.
- Content
Static analysis
No suspicious patterns detected.