Security audit

Wiki Entry Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill has a clear wiki-maintenance purpose, but its bundled scripts allow overbroad local command execution and writes outside the intended vault boundary.

Install only in a high-trust local vault and run under least filesystem privileges. Before broader use, patch or restrict the raw --audit-cmd shell execution, reject absolute and ../ paths, canonicalize every target under the configured vault, and treat note content and wikilinks as untrusted input. Keep the vault in version control or backups because the skill intentionally rewrites and moves files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wiki_entry_step_checkpoint.sh:94
Finding: Arbitrary Shell Command Execution Through Checkpoint Audit Commands
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/wiki_entry_meta_writeback.sh:60
Finding: Missing Vault Confinement Allows Modification or Relocation of Files Outside the Vault
Content: View full analysis
"$WIKI.tmp" && mv "$WIKI.tmp" "$WIKI" ``` #### Content writer ```bash abs_path() { local p="$1" case "$p" in /*) printf '%s' "$p" ;; *) printf '%s/%s' "$VAULT" "$p" ;; esac } WIKI="$(abs_path "$WIKI_REL")" if [ ! -f "$WIKI" ]; then error "Wiki 不存在: $WIKI" exit 1 fi TMP_WIKI="$WIKI.tmp.$$" ``` The constructed path is ultimately replaced: ```bash mv "$TMP_WIKI" "$WIKI" ``` #### Status writer ```bash abs_path() { local p="$1" case "$p" in /*) printf '%s' "$p" ;; *) printf '%s/%s' "$VAULT" "$p" ;; esac } DOC="$(abs_path "$DOC_REL")" ``` The selected file is replaced after transformation: ```bash TMP_DOC="$DOC.tmp.$$" awk -v to_status="$TO_STATUS" ' NR==1 && $0=="---" { in_frontmatter=1; print; next } i ...[truncated 4338 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/wiki_entry_xref_sync.sh:54
Finding: Content-Controlled Wikilinks Enable Cross-Reference Writes Outside the Domain Directory
Content: View full analysis
"${TARGET_FILE}.tmp" && mv "${TARGET_FILE}.tmp" "$TARGET_FILE" else printf '\n## 相关主题\n- [[%s]] — 交叉引用（自动补链）\n' \ "$WIKI_BASENAME" >> "$TARGET_FILE" fi HAD_FIX=1 fi done <<< "$LINKS" ``` ### Technical Analysis The value between `[[` and `]]` is treated as both a logical wiki name and a filesystem path. The extraction expression accepts slash characters, parent-directory components, and other path syntax. For example: ```markdown ## Related Topics - [[../../outside/t ...[truncated 2083 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_shared/query_history.sh:187
Finding: Predictable Temporary Files Permit Symlink-Based File Clobbering
Content: View full analysis
"$RECENT_FILE" : > "$EVO_FILE" : > "$CONTRA_FILE" : > "$RECENT_SEEN" : > "$EVO_SEEN" cleanup() { rm -f "$RECENT_FILE" "$EVO_FILE" "$CONTRA_FILE" \ "$RECENT_SEEN" "$EVO_SEEN" } trap cleanup EXIT ``` ### Technical Analysis Temporary filenames are derived from the shared temporary directory and the process ID. Process IDs are observable or predictable, and the files are not created with exclusive-open semantics. The truncation operation: ```bash : > "$RECENT_FILE" ``` follows symbolic links. A local attacker with access to the same writable temporary directory can pre-create one of the expected names as a symbolic link to another file writable by the Agent account. When the script initializes the temporary file, it truncates the symlink target. The subsequent append operations may also write query results through the symlink. Cleanup removes the symlink name rather than restoring the target file. The code also directly references `$TMPDIR` without the guarded default used elsewhere. If `TMPDIR` is unset under the script's current `set -u` behavior, execution can fail; if it is attacker-controlled, it can redirect temporary storage to an untrusted location. ### Attack Path 1. A local attacker observes or predicts a process ID likely to be assigned to the history-query script. 2. The attacker creates a symbolic link in the shared temporary directory: ```text query-history-PID.recent -> writable_target ``` 3. The script starts with the predicted PID. 4. The initialization redirection follows the symbolic link and truncates `writ ...[truncated 858 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Unlike the other mismatch reports, this one mentions execution of arbitrary shell via an --audit-cmd parameter. If the associated checkpoint/audit helper actually accepts and executes caller-provided shell, that would create a command-injection path inside a skill already authorized to touch repository content and state files, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
4. 所有步骤都要走 `wiki_entry_step_checkpoint.sh` 记录状态。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
4. 所有步骤都要走 `wiki_entry_step_checkpoint.sh` 记录状态。

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script directly executes the user-supplied --audit-cmd with bash -lc, giving the caller arbitrary shell execution in the context of the agent/runtime. That is far broader than a checkpoint/status helper needs, and in this skill context it can be abused to run destructive commands, exfiltrate vault data, or modify unrelated files under the guise of an audit step.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill is explicitly designed to read environment variables and modify files, but it does not declare any tool/permission scope to bound those capabilities. In practice this weakens policy enforcement and reviewability: an operator or runtime cannot easily tell that the skill can read configuration and write wiki, index, state, and status files before invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction at L010 is written as a direct role definition in Chinese and sets the skill's operating behavior in a specific language, with no indication that the user may choose another language. Under the locale-policy rule, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is user-invocable and explicitly says the executor should continue after Step 3 without waiting for confirmation, while also modifying wiki content, metadata, indexes, and note status. Without a clear user-facing warning and confirmation model, an operator may trigger destructive or hard-to-reverse repository changes unexpectedly, especially because the workflow spans multiple files and status transitions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file title and all operational guidance are written entirely in Chinese, and there is no indication that language choice is optional or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: All user-facing instructions in this file are presented exclusively in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This can conflict with language/locale policy requirements that prohibit forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s headings and checklist items are entirely written in Chinese, including operational instructions such as status checks and reporting steps. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language interface exposed by the script is entirely in Chinese in its usage output, and additional user-facing error/status messages throughout the file follow the same pattern. This imposes a specific language on users without any opt-in, fallback, or justification for a locale-specific scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage text is presented only in Chinese, and the rest of the script likewise emits Chinese status and error messages. For a shared shell utility, this is a natural-language locale policy issue because users are not given any language/locale opt-in and no region-specific justification is documented in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This shell script rewrites the target wiki file in place using mv "$TMP_WIKI" "$WIKI", which can replace existing content and is potentially destructive, especially in replace mode. While the script prints a success message afterward, there is no prior confirmation prompt or explicit warning comment/docstring near the write operation itself disclosing that the file will be modified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This shell script presents its argument error and usage text entirely in Chinese, and the rest of the script continues with Chinese status and failure messages. That imposes a specific language on users without any opt-in or justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This shell script replaces the target document by moving a temporary file over the original, which is a file write operation affecting user data. Although the script prints a success message afterward, there is no pre-action warning, confirmation prompt, or explanatory comment/docstring disclosing that the original file will be modified in place.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Because --audit-cmd is executed immediately and there is no confirmation, warning, or policy gate, any caller that can influence this argument can trigger arbitrary shell commands without meaningful user awareness. In an agent skill, this increases the risk of prompt-driven or workflow-driven command execution, especially since the feature is framed as a routine micro-audit rather than a dangerous operation.
Content: No source excerpt is available for this finding.