T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/desensitize.py:337- Finding
Inferred Real Names Are Written to Logs and a Desensitization Report
- Content
View full analysis
- Remediation
View remediation
Security audit
成都大学新生一站式指南
Security checks for vulnerabilities and agentic risk
Overview
This campus guide is coherent, but its included maintenance scripts can expose private chat-derived names and accidentally package local chat data, so users should review it before installing or running those scripts.
The Q&A skill itself is not an exfiltration or persistence tool, and the current published files I inspected do not contain raw chat archives. Treat the maintenance scripts as sensitive: do not run desensitize.py on private exports unless you understand that it can print and save inferred names, and do not rely on package.py or scan_pii_package.py alone to prove a release contains no private chat data. Installation is safest for users who only need the curated campus guide, not the local data-processing pipeline.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/package.py:19- Finding
Release Packaging Fails Open When the Ignore Policy Is Missing
- Content
View full analysis
list[str]: patterns = [] if IGNORE_FILE.exists(): for line in IGNORE_FILE.read_text(encoding='utf-8').splitlines(): line = line.strip() if not line or line.startswith('#'): continue patterns.append(line) return patterns def is_ignored(rel: str, patterns: list[str]) -> bool: for pat in patterns: pat = pat.rstrip('/') if fnmatch.fnmatch(rel, pat): return True # 目录前缀匹配（如 data/raw_desensitized/ 排除其下所有文件） if rel.startswith(pat + '/'): return True return False def collect_files(patterns: list[str]) -> list[Path]: files = [] for root, dirs, names in os.walk(ROOT): root_p = Path(root) # 跳过被忽略的目录 dirs[:] = [d for d in dirs if not is_ignored( root_p.relative_to(ROOT).as_posix() + '/' + d, patterns)] for name in names: f = root_p / name rel = f.relative_to(ROOT).as_posix() if not is_ignored(rel, patterns): files.append(f) return files ``` ### Technical Analysis The package builder recursively includes every file under the project root unless a path matches a pattern loaded from `.skillignore`. If `.skillignore` does not exist, `load_ignore_patterns()` silently returns an empty list, causing `collect_files()` to include all files. The audited artifact does not contain `.skillignore`, even ...[truncated 2096 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scan_pii_package.py:54- Finding
Release PII Scanner Silently Skips Unsupported and Undecodable Files
- Content
View full analysis
int: total = 0 with zipfile.ZipFile(ZIP) as zf: for info in zf.infolist(): if info.is_dir() or not info.filename.endswith(('.md', '.json', '.py')): continue try: text = zf.read(info).decode('utf-8') except Exception: continue probs = check_text(info.filename, text) for p in probs: print(p) total += 1 if total: print(f'\n❌ 发现 {total} 处疑似 PII 残留') return 1 print('✅ 发布包无 PII 残留') return 0 ``` The scanner's pattern set is limited to numeric and account-style identifiers: ```python for label, pat in (('手机号', RE_PHONE), ('身份证', RE_ID), ('邮箱', RE_EMAIL), ('QQ号', RE_QQ), ('学号', RE_STUDENT), ('微信号', RE_WECHAT), ('银行卡', RE_BANK)): ``` ### Technical Analysis The release scanner only examines files ending in `.md`, `.json`, or `.py`. All other files are silently ignored. Files that cannot be decoded as UTF-8 are also silently ignored. As a result, the scanner can print a successful “no PII” result even when an archive contains sensitive content in formats such as: - `.txt`, `.csv`, `.html`, or extensionless files. - UTF-16 or other non-UTF-8 text. - Database, spreadsheet, or export formats. - Binary files containing embedded text. - Renamed chat exports. The scanner also does not identify personal names. This is particularly significant because `scripts/desensitize.py` generates a JSON report containing an inferred real-name list. The package scanner would read that JSON but would not flag the names unless they coincidentally matched another identifier pattern. Silent skipping makes the control fail open and can provide false ass ...[truncated 1785 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (23)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/build_kb.py` — 知识库构建 + PII/灰色交易/schema 校验
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/build_kb.py` — 知识库构建 + PII/灰色交易/schema 校验
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes many generic terms such as 学费, 官网, 就业, 开学, 宿舍 and VPN, which are common across many contexts and can cause the skill to activate when a user did not specifically ask for Chengdu University guidance. Over-broad invocation increases the chance of prompt/context hijacking at the routing layer, privacy leakage from irrelevant conversations being sent into this skill, and user confusion from receiving institution-specific guidance in the wrong context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The metadata and all notice content are presented only in Chinese, indicating the skill is effectively constrained to a single language/locale. There is no accompanying statement that this is optional, user-selectable, or explicitly justified as a region-specific tool.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON provides title, scope, disclaimer, and content, but it does not specify how or when the skill should be invoked. For manifest-style files, missing trigger specificity can cause unintended invocation because there are no explicit trigger phrases, constraints, or exclusion conditions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill file is written as mandatory Chinese-only interaction examples, including the assistant persona and user-facing response patterns, with no indication that language selection is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This Python skill's natural-language interface, documentation, and embedded knowledge content are entirely in Chinese and targeted to Chinese-speaking users, with no indication of language choice or explicit justification for enforcing that locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module documentation states the script checks for residual PII such as QQ numbers and student IDs, implying intent to specifically detect personal identifiers. However, the code uses broad regexes at L1371-L1372 and scans all text at L1408-L1414, which can match benign numbers appearing in addresses, counts, or dates, so the implemented behavior contradicts the stated intent of targeted PII validation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script generates and saves a desensitization report that explicitly includes '真实姓名清单' and '排除名单', which re-materializes sensitive identity information derived from the source chat data. This undermines the privacy goal of the tool: even if message bodies are masked, the output report can still leak real names and candidate names to anyone with access to the output directory or logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code outputs matched chat text and group metadata directly to stdout, which is a data-disclosure action even if the source directory is labeled desensitized. The file contains no confirmation prompt, warning print, or explanatory comment telling the operator that message contents from chat archives will be displayed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script iterates through desensitized group chat logs and prints matching message text directly to stdout, which can still expose sensitive or linkable personal content if terminal output is logged, shared, or copied into reports. In this context the tool is specifically mining chat data for high-value topics, so even partially desensitized content may reveal private discussions, behavioral patterns, or re-identifiable details.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. The module docstring is entirely Chinese and provides no indication that the skill is region-specific or that users may choose another language, which can violate a language-choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The changelog specifies a fixed Chinese conversational style with prescribed phrases such as “同学你来啦” and “让本熊猫来帮你查一下”, indicating the skill is designed to respond in a specific language and tone. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The persona description establishes the skill as a “成都大学风格熊猫向导,” reinforcing a locale-specific communication style. While regional scope may be justified, this file does not indicate any user opt-in or language-choice mechanism, so it may violate the language/locale policy as written.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description specifies a standard reply script in Chinese for answers, which implies the assistant should respond in a fixed language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instructions require the assistant to use fixed Chinese panda-style phrasing like "同学你来啦" and "查证一下哟" for all responses. This imposes a specific language and locale style without offering the user a choice or opt-in, which can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON knowledge base presents all user-facing titles, questions, and answers exclusively in Chinese. Under the policy rule for natural-language violations, forcing a single language without offering a language or locale choice can be a locale-policy issue unless it is clearly documented as region- or language-specific with user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
This JSON content is entirely presented in Chinese and does not state that the skill is intended only for Chinese-speaking users or offer any language/locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy concern unless the regional constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
Many entries instruct users to search Chinese names in WeChat or use Chinese-language campus platforms, but the file does not explicitly document that this knowledge base is locale-specific. Because the file is user-facing natural-language content, this can be interpreted as imposing a language/locale without clear opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content appears to assume Chinese as the required interaction language, and there is no statement that users may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a language/locale policy violation unless the constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file’s user-facing documentation and CLI help strings are entirely in Chinese, which imposes a specific language on users without any opt-in or explanation. Under the language/locale policy, this is a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file's only natural-language description is written solely in Chinese and implies a fixed-language usage context without offering any language choice or documenting a justified locale restriction. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The top-level docstring is entirely in Chinese and presents the script's description and usage only in that language. Under the stated policy, forcing a specific language without opt-in can be a natural-language locale violation unless the constraint is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.