T09 · Insecure Skill Coding Practices
Warning
- Location
optimization-strategies.md:65- Finding
Cross-Tenant Data Disclosure Through a Globally Shared Semantic Cache
- Content
View full analysis
- Remediation
View remediation
Security audit
AI API Cost Optimizer
Security checks for vulnerabilities and agentic risk
Overview
This is a static Chinese-language AI API cost optimization guide with no hidden execution or persistence, though its cache examples need security scoping before real use.
Install this only if you want Chinese-language guidance for AI API cost planning. Treat the pricing data as dated and verify current vendor prices. If you use the cache examples, add tenant/user scoping, authorization checks, sensitive-data exclusions, TTLs, and deletion controls before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description prominently uses Chinese for its core value statement, and the rest of the README continues in Chinese without indicating that other languages are supported. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation triggers are broad natural-language phrases such as '成本优化', '模型对比', and 'API 预算规划', which can match many ordinary conversations without strong scope boundaries. This can cause unintended skill activation and steer responses toward this skill's guidance when the user did not explicitly ask for it, creating context hijacking or inappropriate tool influence rather than direct code-execution risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document is written entirely in Chinese and presents its guidance, labels, and routing descriptions only in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document title and descriptive guidance are entirely in Chinese, and the examples explicitly direct output such as '翻译为中文'. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale/language constraint that should be documented as optional or scoped.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The entire document is written in Chinese, including headings, tables, and recommendations, with no indication that language selection is optional or that the content is intentionally scoped to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content