T01 · Skill Instruction Hijacking
Warning
- Location
scripts/get_git_log.sh:40- Finding
Untrusted Git Metadata Can Hijack Report-Generation Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
weekly-report-generator
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but its configuration file is executed as shell code, which creates avoidable local command-execution risk.
Install only if you are comfortable reviewing the shell script and controlling the config.conf file yourself. Do not use configuration files from untrusted sources, and be aware that commit messages or file names from shared repositories may affect the generated report text.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/get_git_log.sh:15- Finding
Shell Configuration File Is Executed as Arbitrary Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明的用途是“自动生成本周周报，按功能模块归类输出编号列表格式”，但代码实际只是在一个或多个 git 仓库中提取本周指定作者的提交记录和变更统计，输出带有开始/结束标记的原始日志数据。它没有实现周报内容整理、模块归类、编号列表格式化等核心功能。因此其主要行为更接近“收集 git 提交数据”而不是“生成周报”。读取 config.conf 和遍历多个项目目录属于实现细节，但也说明其实际资源访问依赖于本地配置，而非单纯文本生成。整体上描述高估了代码的产出能力，存在明显不匹配。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script includes user-facing comments and error messages entirely in Chinese, such as the configuration and validation output on L9-L11 and L18. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description and output rules require the weekly report to be produced in Chinese, including explicit instructions to simplify commit messages into Chinese and output only that format. This is a natural-language locale constraint, and the file does not offer the user any language choice or opt-in.
- Content