T09 · Insecure Skill Coding Practices
Error
- Location
modules/dependency-graph.md:12- Finding
Unsafe GNU Make Inspection Enables Parse-Time Command Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
makefile-review
Security checks for vulnerabilities and agentic risk
Overview
This Makefile review skill is not clearly malicious, but it can evaluate or test Makefiles and apply generated changes without enough warning or containment.
Install only if you are comfortable with the agent reviewing Makefiles and potentially running Make-related inspection commands. For untrusted repositories, avoid `make -pn`, `make -n`, target testing, and any `--apply` generation unless you explicitly approve it in a sandbox with secrets removed and a clean diff to review.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md @include modules/deduplication-patterns.md
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md @include modules/portability-checks.md
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Plugin Dogfood Checks**: `@include modules/plugin-dogfood-checks.md` - Makefile completeness analysis, target generation, and dogfooding validation.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
makefile # Bad - 'clean' file blocks target clean: rm -rf build/ # Good .PHONY: clean
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
makefile # Bad - 'clean' file blocks target clean: rm -rf build/ # Good .PHONY: clean
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
makefile # Bad - not portable clean: rm -rf /home/user/project/build # Good - variables BUILD_DIR ?= build
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
makefile # Bad - not portable clean: rm -rf /home/user/project/build # Good - variables BUILD_DIR ?= build
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 92% confidence
- Finding
The trigger "build" overlaps with a common built-in command namespace and can shadow or conflict with expected platform behavior. This may route users into this skill instead of the intended built-in build functionality, leading to incorrect actions, confusion, or execution of review-oriented steps in place of the requested command.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad terms like "build," "make," and "automation," which can cause the skill to activate in many unrelated contexts. Unintended invocation increases the chance that the agent follows this skill's workflow when the user did not request a Makefile audit, potentially causing command suggestions or repository inspection in the wrong task context.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Delete on Error
makefile # Automatically delete targets on error .DELETE_ON_ERROR: build/%.o: src/%.c
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module explicitly states it can 'safely test existing targets' and 'generate missing targets,' which materially exceeds the skill's declared audit-only purpose. That scope expansion is dangerous because reviewing Makefiles is a low-risk read-oriented activity, while testing and generation introduce execution and repository modification behaviors that could run untrusted build logic or alter project files without clear user expectation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Claiming the ability to 'safely test existing targets' is especially risky for Makefiles because target execution can invoke arbitrary shell commands defined by the repository. In this skill context, that makes the issue more dangerous: users may expect a reviewer, but the documented behavior implies execution of untrusted build automation, which can affect the local environment, secrets, network, or filesystem.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The workflow sections broaden the skill from Makefile review into functional testing, scoring, and enhancement, including creating new targets. In the context of a security-sensitive agent skill, this mismatch can mislead users and downstream tooling into authorizing actions beyond passive review, increasing the chance of executing unsafe Make recipes or making unintended edits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented
--applygeneration mode says it creates targets but does not explicitly warn that it may modify repository files. In an audit-oriented skill, omission of a write-risk warning is unsafe because users may invoke the mode expecting analysis and instead get persistent Makefile changes, potentially corrupting build logic or introducing unsafe targets.- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 96% confidence
- Finding
The trigger "make" is a very common word in normal conversation and software discussions, so it is likely to activate the skill unintentionally. In this skill's context, accidental activation is somewhat mitigated because the content is review-focused rather than directly destructive, but it still broadens the attack surface for misrouting agent behavior.
- Content