T09 · Insecure Skill Coding Practices
Warning
- Location
clean_script.py:29- Finding
Unsanitized Session Key Allows Path Traversal During Summary Storage
- Content
View full analysis
- Remediation
View remediation
Security audit
Lite Session Cleaner
Security checks for vulnerabilities and agentic risk
Overview
The skill does clean old sessions, but it also reads conversation history and saves session summaries locally without clearly disclosing that behavior.
Review this skill before installing in any environment with private or business conversations. It should either remove session-history summarization and local summary storage, or clearly make them opt-in with retention controls, safe file paths, restrictive permissions, and sanitized identifiers.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description covers stale-session cleanup and notification, which the code does perform. However, the code also performs additional undeclared capabilities before cleanup: it accesses session history, creates a content summary, and persists that summary as JSON files under a local summaries directory. These are materially meaningful behaviors involving message-content processing and local data storage, and they are not implied by simple session cleanup plus notification. Therefore the description does not accurately represent the full behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The advertised purpose is only to clean inactive sessions and notify users, but the implementation also retrieves conversation history, generates summaries, and stores them on disk. This is a material capability mismatch that creates undisclosed access to potentially sensitive conversation data and expands the skill’s data-handling scope beyond what is necessary for cleanup.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script accesses session conversation content and persists derived content to local files even though session cleanup does not require reading message bodies. This violates least privilege and data minimization principles, increasing the risk of privacy exposure, unauthorized retention, and later compromise of stored summaries.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 74% confidence
- Finding
The skill describes behaviors that can write logs and perform session-affecting actions, but it declares no explicit tool scope or permissions boundary. In an agent environment, missing scope declarations increases the chance the runtime grants broader capabilities than users expect, enabling unintended file writes or other side effects without clear consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This skill automates termination of user sessions after inactivity, but the description does not prominently warn users that sessions will be forcibly ended without an interactive confirmation step. That creates a safety and availability risk because users may lose ongoing work or be surprised by automated administrative action in shared or production environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Summarizing session history and writing it to disk without explicit notice or consent creates silent local persistence of potentially sensitive user data. Even if only summaries are stored, they may still contain personal, confidential, or regulated information and can outlive the original session unexpectedly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill specifies a fixed message string, "当前会话已经结束", which forces a specific language for user-facing communication. There is no indication that the language is configurable, user-selected, or justified as a region-specific requirement.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The cleanup routine automatically calls send_notification(target, ...) using the session target identifier, which represents an outbound messaging action. While the code logs the action, there is no broader disclosure in the skill documentation or main cleanup description that cleanup includes sending notifications to users or endpoints.
- Content