T09 · Insecure Skill Coding Practices
Error
- Location
scripts/compile_step_checkpoint.sh:105- Finding
Arbitrary Command Execution Through Caller-Controlled Audit Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
Compile Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent local knowledge-workflow purpose, but it exposes broad shell and file-mutation authority that deserves review before installation.
Install only in a trusted local vault with backups or version control. Do not let untrusted note content or model-generated text choose --audit-cmd values or file paths, and review configured COMPILE_* directories so archive and cleanup operations cannot touch unrelated files.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/compile_archive.sh:36- Finding
Destructive File Operations Are Not Restricted to Configured Workspace Directories
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/compile_task_logger.sh:61- Finding
Unescaped User-Controlled Values Can Corrupt or Forge Structured Run Logs
- Content
View full analysis
"$OUT" <- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The described helper supports execution of arbitrary shell commands via an audit parameter using 'bash -lc', which is a direct command-injection surface if any part of that argument can be influenced by note content, model output, or an untrusted operator. Within a skill that processes untrusted markdown and metadata, this substantially increases the chance of arbitrary code execution, data destruction, or unauthorized filesystem access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The described helper supports execution of arbitrary shell commands via an audit parameter using 'bash -lc', which is a direct command-injection surface if any part of that argument can be influenced by note content, model output, or an untrusted operator. Within a skill that processes untrusted markdown and metadata, this substantially increases the chance of arbitrary code execution, data destruction, or unauthorized filesystem access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The described helper supports execution of arbitrary shell commands via an audit parameter using 'bash -lc', which is a direct command-injection surface if any part of that argument can be influenced by note content, model output, or an untrusted operator. Within a skill that processes untrusted markdown and metadata, this substantially increases the chance of arbitrary code execution, data destruction, or unauthorized filesystem access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The described helper supports execution of arbitrary shell commands via an audit parameter using 'bash -lc', which is a direct command-injection surface if any part of that argument can be influenced by note content, model output, or an untrusted operator. Within a skill that processes untrusted markdown and metadata, this substantially increases the chance of arbitrary code execution, data destruction, or unauthorized filesystem access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The described helper supports execution of arbitrary shell commands via an audit parameter using 'bash -lc', which is a direct command-injection surface if any part of that argument can be influenced by note content, model output, or an untrusted operator. Within a skill that processes untrusted markdown and metadata, this substantially increases the chance of arbitrary code execution, data destruction, or unauthorized filesystem access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The described helper supports execution of arbitrary shell commands via an audit parameter using 'bash -lc', which is a direct command-injection surface if any part of that argument can be influenced by note content, model output, or an untrusted operator. Within a skill that processes untrusted markdown and metadata, this substantially increases the chance of arbitrary code execution, data destruction, or unauthorized filesystem access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The described helper supports execution of arbitrary shell commands via an audit parameter using 'bash -lc', which is a direct command-injection surface if any part of that argument can be influenced by note content, model output, or an untrusted operator. Within a skill that processes untrusted markdown and metadata, this substantially increases the chance of arbitrary code execution, data destruction, or unauthorized filesystem access.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. 行动前先查：文件名核对和生成正文前都要先查历史（`query_history.sh`）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. 所有步骤都要走 `compile_step_checkpoint.sh` 记录状态。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. 所有步骤都要走 `compile_step_checkpoint.sh` 记录状态。
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script takes an arbitrary string from --audit-cmd and executes it with
bash -lc, which grants full shell execution in the context of the agent or user running the skill. In a skill intended for compile/progress checkpointing, this is far broader than necessary and becomes especially dangerous because upstream notes, metadata, or agent-generated values could be routed into this parameter and trigger command injection or unauthorized actions.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README specifies default derived directories using Chinese names (
Knowledge/中转站/andKnowledge/原材料仓库/) without offering a language or locale choice. This is a natural-language locale constraint in the skill behavior and documentation, and no opt-in or justification is provided.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title explicitly labels the file as a Chinese-only description, and the entire document is written in Chinese without indicating that other language options are available. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless a justified locale constraint is documented.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares broad executable dependencies and describes file reads/writes across configurable directories, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope metadata can allow the skill to be invoked with more capabilities than operators expect, increasing the risk of unintended file access, modification, or indirect network use through helper scripts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill body begins with a direct instruction in Chinese, framing the agent as a Chinese-language executor without offering a language choice. Under the policy, forcing a specific language or locale is a natural-language policy violation unless the constraint is optional or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document is written entirely in Chinese and uses mandatory language such as '必须', which indicates the skill content is intended to operate in a fixed language. There is no indication that users may choose another language or that the Chinese-only requirement is justified by a region-specific purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains prescriptive language rules that require Chinese handling of titles, such as '中文标题' and adding '中文副标题', but it does not indicate that users may opt into another language or that the restriction is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown workflow instructs the skill to move source files and images, write back metadata, and append logs, which can affect user data and repository state. The document gives procedural steps but does not include a user warning or disclosure about these side effects, which is required for markdown files when behavior could affect data or system integrity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The usage text shown to users is hard-coded in Chinese, and the rest of the script also emits Chinese status and error messages. For a code file, this is a natural-language locale policy issue because it enforces a specific language without any opt-in, fallback, or documented regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This shell script moves the source file and asset directory, then rewrites both the archived source and compiled markdown files via the embedded Python block. Although it prints success/error status, there is no confirmation prompt or clear warning comment/docstring disclosing that user files will be relocated and modified in place, which is safety-relevant for a general-purpose archive operation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script description and all user-facing usage/output text are written exclusively in Chinese, establishing a fixed language requirement for users. The file does not offer a language choice, fallback, or documented justification that this tool is intentionally limited to a Chinese-speaking or region-specific environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script emits user-facing status and error messages exclusively in Chinese, including the unknown-parameter error, usage text, and configuration failure notice. For a general-purpose shell skill, this is a natural-language locale constraint without user opt-in or documented regional justification, which fits the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script emits user-facing messages in Chinese at L38 and L44, and also embeds a Chinese default path component at L13, indicating a fixed locale assumption. This can violate language/locale policy when the skill is not explicitly documented as Chinese-only or offering user opt-in for language selection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script emits user-facing messages exclusively in Chinese, including usage and error text, with no indication that the skill is region-specific or that another language can be selected. This is a natural-language policy concern because it imposes a specific language on users without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script executes the supplied --audit-cmd immediately and non-interactively, with no warning, confirmation, or trust boundary check. In an agent skill context, silent command execution increases the chance that unreviewed or adversarial input will be run under operator credentials, turning a risky design into an easier exploitation path.
- Content
Static analysis
No suspicious patterns detected.