T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:163- Finding
Unsafe Process Termination and Execution of an Unverified External Script
- Content
View full analysis
- Remediation
View remediation
Security audit
Core Capabilities
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a documented integration for Obsidian, Git, memory queries, and monitoring, but it gives broad file, sync, background-service, and external-script instructions without enough scoping or user-control guidance.
Review this skill before installing in any workspace with sensitive notes, credentials, or private repositories. Only use it where Obsidian, Git, memory sync, cron jobs, and localhost monitoring are intended; require explicit confirmation before file edits, deletes, commits, pushes, manual sync, or service restarts; and verify the external scripts memory_query_agent.py and monitor_server.py separately because they are not part of this reviewed package.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The publication guide documents state-changing commands such as note creation and
git pushwithout any warning, confirmation step, or mention that these actions modify local data and may synchronize it to remote repositories. In a skill intended for assistant use, this can lead to unintended file changes or data exfiltration if an agent follows the examples too literally.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## 🔗 相关链接 - **技能文件**: `skills/core-capabilities/SKILL.md` - **使用说明**: `skills/core-capabilities/README.md` - **元数据**: `skills/core-capabilities/metadata.json` - **监控页面**: http://localhost:8003/cron_status_clickable.html
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises automated Obsidian and Git synchronization capabilities but does not warn that these functions may modify local notes, repositories, or synchronized state. Users or downstream agents may invoke the skill assuming it is read-only, increasing the risk of unintended writes, commits, sync conflicts, or propagation of sensitive content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly advertises only "中文自然语言支持" and all user-facing documentation/examples are in Chinese, with no indication that users may select another language. This is a natural-language policy concern because it imposes a specific language without opt-in or documented justification.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Publishing the precise workspace installation path reveals internal directory structure and confirms the presence and naming of a local skill file. While not severe on its own, this information can aid reconnaissance by helping an attacker or misused agent enumerate sensitive files and better target subsequent actions.
- Content
技能已安装在工作区：
bash ~/.openclaw/workspace/skills/core-capabilities/SKILL.md🚀 使用方式
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md python3 memory_query_agent.py --sync-status # Cron 任务 crontab -l | grep memory # 监控服务 ps aux | grep monitor_server
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md python3 memory_query_agent.py --sync-status # Cron 任务 crontab -l | grep memory # 监控服务 ps aux | grep monitor_server
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The example trigger phrase is broad enough to match ordinary user requests such as asking what capabilities are available, which can cause the skill to activate unexpectedly. In a skill that exposes operational functions like sync, memory access, and status inspection, over-broad triggering increases the chance of unintended tool use or disclosure of internal system details.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list contains broad phrases such as '核心能力', '能力清单', and '系统能力' that are likely to match ordinary conversation and cause the skill to activate unintentionally. Because this skill exposes operational guidance for file management, Git synchronization, memory querying, and monitoring, over-broad activation can steer the agent into sensitive workflows without explicit user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The single-word trigger 'obsidian' is overly generic and likely to collide with routine references to the Obsidian product, notes, or workflows. This increases the chance of accidental skill invocation and can expose filesystem, task, and sync capabilities in contexts where the user only intended discussion, not tool-guided action.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises create/read/edit/delete/move note operations but does not warn about modification or deletion risk, increasing the chance that a user or agent will treat destructive actions as routine. In an agentic setting, missing safety framing can lead to irreversible data loss or unintended changes to a knowledge base.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - **开发者工具**: CDP、DOM 检查、CSS 调试 **关键文件**: - `skills/obsidian-cli/SKILL.md` - CLI 完整文档 - `skills/obsidian-tasks/SKILL.md` - 任务管理 #### Git 同步能力
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md **关键文件**: - `skills/obsidian-cli/SKILL.md` - CLI 完整文档 - `skills/obsidian-tasks/SKILL.md` - 任务管理 #### Git 同步能力 - **安全操作**: 防误删、防敏感信息泄露
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md obsidian daily # 创建笔记 obsidian create name="测试" content="内容" # 搜索 obsidian search query="关键词"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Git workflow includes 'git add .', commit, and push instructions without warning that local content may contain secrets, unintended files, or unreviewed changes that will be published remotely. In environments handling notes, memory stores, logs, or config artifacts, this can cause sensitive data leakage or permanent propagation of mistakes to remote repositories.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad generic terms such as '核心能力', '能力清单', '系统能力', and 'obsidian', which are likely to appear in normal conversation and can cause the skill to activate unintentionally. In a skill that exposes Git, memory querying, local monitoring, and system-status functions, accidental invocation increases the chance of unnecessary disclosure of internal state or execution of sensitive workflows outside the user's actual intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest presents the skill description and invocation phrases only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-only audience. This can violate language/locale policy when no opt-in or justification is provided.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list contains generic phrases such as '核心能力', '能力清单', and '系统能力' that are likely to match ordinary user requests about general capabilities, causing the skill to activate outside its intended scope. Because this skill bundles sensitive functions like Obsidian/Git sync, memory database access, and monitoring endpoints, over-broad activation increases the chance of unintended invocation and unnecessary exposure of internal capabilities.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The phrase "中文完全支持" appears in the feature description without any indication that users can choose another language or that Chinese-only behavior is optional. Under the policy, forcing or implying a fixed language without user opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description and examples are written as if the skill is intended to operate in Chinese, and the query capability explicitly highlights Chinese support, but there is no indication that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.