T09 · Insecure Skill Coding Practices
Error
- Location
tool_catalog.json:58- Finding
Shell Command Injection in L0 Fallback Invocation Templates
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Router
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible router, but it includes broad fallback and orchestration instructions that can lead to shell commands, external API calls, email sending, and prompt-injection exposure without tight scoping or confirmation.
Install only if you are comfortable reviewing and constraining the fallback catalog yourself. Do not allow automatic execution of its exec templates, email steps, package installs, or external API calls without explicit confirmation and proper input escaping.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
router_top5.py:476- Finding
Untrusted Indexed Skill Instructions Are Injected into the LLM Selection Prompt
- Content
View full analysis
str: """Format as a text block for the LLM.""" lines = [ f"{index}. {self.name} (relevance: {self.relevance:.2f})", f" Description: {self.description}", ] if self.capabilities: lines.append(f" Capabilities: {', '.join(self.capabilities)}") if self.brief_guide: lines.append(f" Guide: {self.brief_guide}") if self.body_start: lines.append(f" Details: {self.body_start}") lines.append(f" Path: {self.path}") return "\n".join(lines) ``` ### Technical Analysis The router reads `body_start` and `brief_guide` from `skill_index.json`, which aggregates instructional text from many third-party Skills. These fields are inserted verbatim into a prompt described as being sent directly to the LLM. The index contains imperative operational material, including package installation, API calls, cron setup, and instructions telling an Agent how it should act. The serialization format does not: - Mark indexed text as untrusted data. - Escape or normalize instruction-like content. - Separate candidate metadata from executable Skill instructions. - Restrict the LLM to a structured selection response. - Verify a selected Skill in a separate trust boundary. Consequently, a malicious or c ...[truncated 1552 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
router_top5.py:22- Finding
Unpinned Embedding Model Downloaded from a Third-Party Mirror
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
tool_catalog.json:19- Finding
Unpinned Global npm Package Installation in AI Fallback Setup
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (64)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the claimed embedding, translation, reranking, and rejection mechanisms are absent, the skill may handle ambiguous or information-only queries without the promised safeguards. In a router, missing guardrails are security-relevant because they directly affect whether sensitive prompts, external-tool invocations, or inappropriate LLM context exposure are prevented.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the claimed embedding, translation, reranking, and rejection mechanisms are absent, the skill may handle ambiguous or information-only queries without the promised safeguards. In a router, missing guardrails are security-relevant because they directly affect whether sensitive prompts, external-tool invocations, or inappropriate LLM context exposure are prevented.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the claimed embedding, translation, reranking, and rejection mechanisms are absent, the skill may handle ambiguous or information-only queries without the promised safeguards. In a router, missing guardrails are security-relevant because they directly affect whether sensitive prompts, external-tool invocations, or inappropriate LLM context exposure are prevented.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the claimed embedding, translation, reranking, and rejection mechanisms are absent, the skill may handle ambiguous or information-only queries without the promised safeguards. In a router, missing guardrails are security-relevant because they directly affect whether sensitive prompts, external-tool invocations, or inappropriate LLM context exposure are prevented.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a sophisticated router that does embedding coarse filtering, LLM reranking, Chinese-to-English query translation, and triple rejection logic. In contrast, match_chain() only lowercases the query and scores chains by trigger_caps, substring keyword matches, and step capability overlap from local JSON data, with no embedding, no LLM call, no translation, and no rejection pipeline.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The action-phrase exemption list contains ambiguous, high-frequency phrases like '给我', '把', '查一下', and '列出来', and applies them based on query prefix. Because these phrases are generic instruction openers, an attacker or ordinary user can easily craft unrelated text that bypasses the rejection layer and gets treated as actionable skill intent, undermining the router's safety boundary.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The
using-superpowersrule mandates skill invocation whenever there is even a 1% chance a skill might apply, which is effectively an always-on trigger. In a skill ecosystem containing many powerful and instruction-bearing entries, this creates a strong prompt-injection and over-activation risk by forcing the agent to consult more potentially adversarial content than necessary.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The fallback catalog exposes powerful side-effecting capabilities—email sending, browser automation, file downloads, local script execution, and remote API access—inside a skill whose stated purpose is routing/selection rather than execution. This creates dangerous scope expansion: if the router or downstream policy misfires, an attacker can pivot from benign query routing into outbound actions, data exfiltration, or code execution that users would not reasonably expect from a routing layer.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The email capability can send real outbound messages from a configured sender account, but the catalog does not prominently warn about this side effect or require confirmation. In a fallback path, this is especially dangerous because a low-confidence routing failure could unexpectedly trigger external communication, spam, phishing, or sensitive data leakage.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 79% confidence
- Finding
The skill advertises capabilities that involve local resources and environment-injected API keys, but it does not declare an explicit tool/permission scope. That creates an authorization ambiguity: a host may grant broader file or environment access than reviewers and users expect, increasing the chance of unintended secret exposure or local file access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Forcing Chinese queries to be translated into English without user choice can alter meaning and may send sensitive content through additional processing stages, increasing privacy and integrity risk. In a routing skill, translation errors can also cause incorrect tool selection, especially for medical, legal, or safety-sensitive requests where nuance matters.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and surrounding instructional text are written entirely in Chinese, and the taxonomy design explicitly centers Chinese query handling alongside English rather than offering a user language choice. This can violate a language/locale policy when a skill imposes a specific language experience without documented opt-in or justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a routing engine that selects among skills after embedding and LLM ranking, with rejection of purely informational queries. In this file, the router taxonomy explicitly classifies actionable capabilities such as sending email, task management, and system operations, which goes beyond a narrowly described information-routing function and embeds orchestration over sensitive operational domains.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The ChainStep documentation states input_mapping values may be "query", but format_plan() checks only for source == "$query" before rendering it as the user's original query. This is an active contradiction between the documented mapping convention and the implemented handling.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest presents the skill as a routing engine for picking top 5 skills, but this file formats execution plans and generates per-step execution context for multi-step chains. That is broader than ranking skills and indicates orchestration support rather than just routing.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The router manifest includes an email-sending step in the paper_writing chain, which creates an external side effect unrelated to the stated purpose of selecting or routing skills. If invoked automatically or implicitly, it can transmit generated content and references to an email destination without clear user intent, expanding the attack surface from routing into data exfiltration or unintended outbound actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The email-sending step lacks any indication of user-facing warning, disclosure, or consent flow before outbound transmission. Without a clear notice that content will leave the system, users may unknowingly cause sensitive draft material or references to be sent externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The search_and_email workflow summarizes literature and emails the result without any documented warning that content will be transmitted externally. This lack of transparency increases the risk of inadvertent disclosure and violates the principle of explicit user consent for side-effectful actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The search_and_email chain directly sends summarized content by email, which exceeds the declared scope of a routing engine and introduces an unnecessary exfiltration pathway. In a router context, users may expect skill selection assistance, not automatic delivery of content to external recipients, making unintended disclosure more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The daily_research chain uses broad trigger keywords such as general references to daily research updates, which can overlap with ordinary conversation. In combination with downstream email behavior, loose activation conditions increase the chance that a benign query unintentionally launches a workflow with external side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The daily research sync chain performs automatic email notification without any explicit disclosure or confirmation mechanism in the manifest. Combined with broad triggers, this can cause users to initiate external messaging without understanding that a send operation will occur.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The daily_research chain automatically emails summaries as part of a triggerable workflow, which is a side effect outside the expected function of a skill router. Because this chain can be activated by broad keywords, it increases the risk of unintentional outbound transmission of generated or aggregated content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Using a single vague keyword for manual_review makes the chain easy to activate accidentally from normal language. While the chain itself is not highly dangerous, ambiguous routing can cause unexpected tool execution and reduce user control over which workflow is selected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module description and all user-facing documentation/comments are written entirely in Chinese and describe the classifier as tailored to Chinese medical research scenarios. There is no indication that users can choose another language or that the Chinese-only behavior is optional, which can violate language/locale policy for general-purpose skills.
- Content