T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_card.py:101- Finding
Path Traversal Through Unsanitized Vocabulary Filenames
- Content
View full analysis
- Remediation
View remediation
Security audit
English Visual Vocabulary
Security checks for vulnerabilities and agentic risk
Overview
This is mostly an English vocabulary study skill, but it needs review because one script can write files outside its intended output folder when given crafted word input.
Install only if you are comfortable with a Chinese-language, local-file-based study helper. Avoid running the card-generation scripts on untrusted word lists until filenames are validated, and confirm before using image search or generation because vocabulary prompts may be sent to external services.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明中包含多个核心功能：视觉化图片辅助记忆、智能配图、词根词缀分析、音标标注，以及学习计划与艾宾浩斯复习。代码中确实实现了‘创建学习计划’和‘艾宾浩斯复习时间表’这两部分，但其余被重点宣称的学习功能均未出现。脚本没有图像处理、图片检索/生成、词根词缀分析、音标处理，也没有真正从词库读取详细词汇数据，而是生成占位符单词（word_1 等）。因此，代码行为只覆盖了描述中的一部分，且实际主要用途是离线生成计划文件，不足以准确代表所宣称的完整智能学习工具。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该代码与描述存在明显功能落差。描述强调的是一个较完整的英语词汇学习系统，核心卖点包括视觉化图片记忆、智能配图、词根词缀分析、音标标注和学习计划管理。实际代码仅围绕艾宾浩斯复习提醒展开，功能集中在本地 JSON 学习日志的记录、固定间隔复习调度、复习标记及 Markdown 报告生成。虽然这与描述中的“配合艾宾浩斯遗忘曲线”部分一致，但不足以覆盖其宣称的主要能力。代码也没有额外可疑越权行为；不匹配主要是描述显著夸大了已实现功能。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
该代码与描述存在明显能力层面的不一致。描述将技能定位为较完整的英语词汇学习工具，包含学习计划、智能配图、音标标注、词根词缀分析和基于艾宾浩斯遗忘曲线的记忆支持；但实际代码只是一个离线的单词卡片生成脚本。其已实现部分主要是：接收单词和风格参数、构造带占位信息的数据结构、进行非常基础的词根词缀子串匹配、输出 Markdown/JSON 文件。虽然“词根词缀分析”和“视觉化卡片”方向与声明部分相关，但多数核心能力仅停留在注释或占位层面，未真正实现。因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 81% confidence
- Finding
代码行为与“单词学习卡片生成、图片风格、词根分析”这部分声明基本一致，但声明中的若干核心能力在所提供代码中没有体现。该脚本主要完成批量处理单词、生成卡片文件和学习总结文档，并未实现或展示学习计划管理、音标标注、或任何与艾宾浩斯遗忘曲线相关的复习安排逻辑。虽然可能有部分能力隐藏在未提供的 generate_card 模块中，但基于当前代码块可确认的功能范围，描述比实际行为更宽，存在能力层面的不准确表述。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README suggests conversational trigger phrases such as “帮我背单词” and similar natural-language requests that are broad enough to overlap with ordinary chat. In an agent environment, overly generic triggers can cause the skill to activate unexpectedly, creating confusing routing or unintended use of connected tools, even though the skill’s educational context makes the impact moderate rather than severe.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises
image_generateandsearch_imagescapabilities but does not warn users that prompts, vocabulary terms, or other learning inputs may be sent to external services. This creates a transparency and privacy risk because users may unknowingly disclose personal study content or sensitive text through network-backed image search/generation flows.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Top-level manifest triggers include generic phrases such as '学英语' and '英语学习', which are broad enough to overlap with many unrelated conversations. In agent ecosystems, overbroad routing can misfire into the wrong skill and, when paired with external tools, may create unnecessary exposure of user prompts or downstream actions not intended by the user.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Broad trigger phrases like '背单词', '帮我学英语', and similar everyday learning requests increase the chance of unintended skill invocation. That can cause the agent to activate this skill in contexts where the user wanted general tutoring, potentially leading to unexpected tool usage, confusing outputs, or unnecessary access to linked capabilities such as image search/generation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The markdown template labels and instructions are written in Chinese, including fields like "中文释义" and the root-analysis text, which indicates the skill expects Chinese-language output by default. There is no indication that the user can opt into another language or that the skill is specifically limited to a Chinese-learning context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all headings, instructions, and explanations in Chinese, which effectively forces a specific language for users without any opt-in or alternative. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill is presented as an "English Visual Vocabulary Skill" centered on English-word study, but the documentation does not clarify whether language selection is configurable or intentionally limited. Because locale/language restrictions should be explicit or user-selectable, this may create a policy concern if the skill implicitly forces one language mode.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The description presents the skill as specifically for learning English vocabulary and all examples assume English as the target language, without indicating that users may choose another language or that the English-only scope is an explicit opt-in. This can be read as a language policy constraint expressed in natural language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents all instructions, examples, and usage guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This JSON manifest-like file contains only a general description of an advanced vocabulary list and does not specify any trigger phrases, activation conditions, or exclusion conditions. In a manifest/plain-text context, the absence of explicit trigger scope can make it unclear when the skill should activate versus when it should not.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description is written in Chinese and the schema uses fields such as "chinese_meaning", which indicates the skill content is fixed to a Chinese-language learning context without offering a user language choice. The policy calls for flagging language or locale constraints when they are imposed without opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The description is written only in Chinese and the schema uses a dedicated
chinese_meaningfield, which indicates the vocabulary resource is tailored to Chinese-speaking users without stating that this locale is optional or user-selected. The policy requires avoiding forced language/locale assumptions unless the constraint is explicitly documented and justified.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON file contains natural-language content and schema fields that consistently present meanings in Chinese, such as the Chinese description and the "chinese_meaning" field. Because the file does not indicate that this is an opt-in Chinese-language resource or a region-specific variant, it may violate the policy against forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural-language descriptions and messages entirely in Chinese, beginning with the module docstring and continuing throughout the script. The skill does not provide any user opt-in or alternative language handling, which can violate language/locale policy when a default language is forced implicitly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains user-facing descriptions and runtime messages in Chinese only, starting with the module docstring and continuing throughout the CLI. Under the policy for natural-language violations, forcing a specific language without user opt-in can exclude users who expect a different locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This is a natural-language policy concern because the file forces a specific language in its descriptions and CLI help text rather than allowing user opt-in or documenting a justified regional scope. Users in other locales would receive prompts and output in Chinese with no alternative.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The argparse description, help strings, and printed success message are user-facing natural-language content restricted to one language. Under the policy, that should either be optional, user-selectable, or clearly justified as a region-specific tool.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The module docstring and class docstring are written only in Chinese, which imposes a specific language on users and maintainers without any opt-in or alternative locale. The policy explicitly allows fixed locale only when documented and justified, which is not present here.
- Content