T09 · Insecure Skill Coding Practices
Warning
- Location
references/kb_mounting.md:30- Finding
Potential Disclosure of Confidential Procurement Data Through External MCP Searches
- Content
View full analysis
- Remediation
View remediation
Security audit
bid-rejection-decision-support
Security checks for vulnerabilities and agentic risk
Overview
This looks like a legitimate procurement decision-support skill, but it may send sensitive bid-case facts to external knowledge searches without requiring consent or redaction.
Review before installing if you handle nonpublic bids, evaluation records, prices, bidder deficiencies, or complaint strategy. Use it only in an approved MCP environment, and avoid sending real names, project identifiers, exact prices, personal data, or verbatim confidential document text in search queries unless your organization has approved that data flow.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README presents the skill entirely in Chinese and frames the interaction/output in Chinese terms, but it does not state that the language is optional or user-selectable. Under the policy, a skill should not implicitly force a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The display name and description force a specific language/locale presentation, and the rest of the skill instructions continue exclusively in Chinese. The file does not state that the skill is region-specific for language reasons or offer an opt-in/choice, which matches the language-policy violation criterion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and entire instruction set are written as mandatory Chinese-language guidance, and the file does not state that language choice is optional or limited to a justified region-specific compliance context. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file requires that every response end with a fixed Chinese disclaimer, which imposes a specific language/locale behavior. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is entirely written as a standardized Chinese rejection-wording template library and presents the templates as mandatory wording to use in reports. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale policy violation unless the locale constraint is explicitly documented and justified; this file does not provide such opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest presents the skill name and full description only in Chinese, which can constitute a language/locale policy concern when no alternative language, locale scope, or user opt-in is documented. There is no indication that the skill is intentionally limited to a Chinese-speaking or China-specific compliance context.
- Content
Static analysis
No suspicious patterns detected.