T09 · Insecure Skill Coding Practices
Error
- Location
scripts/iron-heartbeat.js:202- Finding
Reviewer-Controlled Instructions Are Executed as Unrestricted Shell Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Test-Driven Revolution
Security checks for vulnerabilities and agentic risk
Overview
This skill is an automated coding workflow, but it can run model- or review-provided shell commands on a recurring schedule without real sandboxing or strong user control.
Review carefully before installing. Do not enable the cron jobs or run the heartbeat on a workspace containing secrets or valuable files unless the executor is replaced with a real sandbox, task IDs and paths are strictly validated, review inputs are authenticated and schema-checked, and every generated command is approved or constrained to a safe allowlist.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (8)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apply-review.js:81- Finding
Unauthenticated Review JSON Is Promoted Into Executable Task State
- Content
View full analysis
= task.max_iterations) { task.status = 'failed'; } else { task.status = 'pending'; } } else { task.status = 'reviewed'; } ``` ### Technical Analysis Review content is accepted from an arbitrary file, standard input, or command-line text. The only substantive ...[truncated 1144 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
scripts/trigger-review.js:84- Finding
Untrusted Task Content Can Hijack the Reviewer Prompt
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/security-scan.js:10- Finding
Regex Blacklist Does Not Prevent Dangerous Shell Execution
- Content
View full analysis
]+>\s+(\/etc|\/proc|\/sys)/, reason: '写入系统目录' }, { pattern: /rm\s+-rf\s+\*\s*$/, reason: '删除当前目录所有文件' }, { pattern: />\s*\/dev\/sd[a-z]/, reason: '直接写入磁盘设备' }, { pattern: /nc\s+-e\s+(ba)?sh/, reason: '反向 Shell' }, { pattern: /python\s+-c\s+['"].*socket/, reason: 'Python Socket 操作（可能为反向 Shell）' }, { pattern: /base64\s+-d\s*\|\s*(ba)?sh/, reason: 'Base64 解码执行' }, { pattern: /eval\s+\$/, reason: '动态执行变量内容' }, { pattern: /`\$[^`]+`/, reason: '命令替换执行变量' }, ]; ``` The declared allowlist is not enforced: ```javascript const ALLOWED_COMMANDS = [ 'node', 'npm', 'npx', 'python', 'python3', 'pip', 'pip3', 'bash', 'sh', 'zsh', 'echo', 'cat', 'ls', 'pwd', 'mkdir', 'cp', 'mv', 'grep', 'sed', 'awk', 'head', 'tail', 'wc', 'git', 'diff', 'patch', 'jq', 'node -e', ]; ``` ### Technical Analysis A finite regex blacklist cannot safely validate arbitrary shell programs. The scanner only recognizes specific textual forms. Equivalent behavior can be expressed through other interpreters, package lifecycle scripts, separate download and execution steps, alternat ...[truncated 1020 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/heartbeat-coordinator.js:48- Finding
Task Identifiers Are Interpolated Into Shell Commands
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/force-unlock.sh:83- Finding
Recovery Script Arguments Are Injected Into Inline JavaScript
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/activate-queued-tasks.js:38- Finding
Unvalidated Task IDs Permit Path Traversal and Out-of-Scope JSON Mutation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/iron-heartbeat.js:175- Finding
Acceptance Verification and Post-Execution Audit Automatically Trust Successful Commands
- Content
View full analysis
{ // 简化的验证逻辑 - 实际应该根据具体标准执行检查 // 例如：检查文件是否存在、测试是否通过等 const passed = true; // 占位符 return { criterion, passed }; }); const allPassed = results.every(r => r.passed); console.log(`验收结果：${allPassed ? '✅ 通过' : '❌ 失败'}`); return { allPassed, results }; } ``` From `scripts/auditor-review.js`: ```javascript function simpleAudit(task) { const issues = []; if (!task.review || !task.review.next_instructions) { issues.push('缺少 review.next_instructions'); } const lastHistory = task.history && task.history[task.history.length - 1]; if (!lastHistory || lastHistory.action !== 'execution_completed') { issues.push('缺少执行记录'); } if (lastHistory && lastHistory.status === 'failed') { issues.push(`执行失败：${lastHistory.error}`); } if (task.review && task.review.acceptance_criteria) { // 简化：假设执行成功=验收通过 // 完整版本：应该实际运行测试验证 if (lastHistory && lastHistory.status === 'failed') { issues.push('验收标准未通过（执行失败）'); } } if (issues.length > 0) { return { verdict: 'fail', confidence: 0.9, feedback: `发现 ${issues.length} 个问题`, issues, next_action: issues.some(i => i.includes('执行失败')) ? 'return_to_reviewer' : 'block_for_human' }; } else { return { verdict: 'pass', confidence: 0.8, feedback: '审核通过，执行结果符合预期', issues: [], next_action: 'proceed_to_next' }; } } ``` ### Technical Analysis Every acceptance criterion is marked as passed unconditionally. The auditor then equates a successfu ...[truncated 1011 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/auto-plan.js "更新 references 文档"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/auto-plan.js "更新 references 文档"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/auto-plan.js "更新 references 文档"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/auto-plan.js "更新 references 文档"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/auto-plan.js "更新 references 文档"
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code explicitly claims to run task instructions "in a sandbox," but actually passes reviewer-controlled
next_instructionsdirectly toexecSync(...)on the host. Any attacker who can influence task content can achieve arbitrary command execution with the privileges of this process, leading to full host compromise, data theft, or lateral movement.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
execSync(instructions, ...)executes task/review-provided instructions as a shell command without warning, sanitization, or allowlisting. Because the instruction source is workflow data rather than trusted code, this is a direct command-injection/arbitrary-code-execution sink on the host environment.- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
js { pattern: /rm\s+-rf\s+\/\s*$/, reason: '删除根目录' }, { pattern: /rm\s+-rf\s+~\s*$/, reason: '删除用户主目录' }, { pattern: /rm\s+-rf\s+\/\*/, reason: '删除所有根目录文件' }, { pattern: /curl\s+[^|]+\|\s*(ba)?sh/, reason: '远程代码执行（curl | sh）' }, { pattern: /wget\s+[^|]+\|\s*(ba)?sh/, reason: '远程代码执行（wget | sh）' }, { pattern: /chmod\s+777/, reason: '设置全权限（chmod 777）' }, { pattern: /\bsudo\b/, reason: '提权操作（sudo）' },
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
js { pattern: /rm\s+-rf\s+~\s*$/, reason: '删除用户主目录' }, { pattern: /rm\s+-rf\s+\/\*/, reason: '删除所有根目录文件' }, { pattern: /curl\s+[^|]+\|\s*(ba)?sh/, reason: '远程代码执行（curl | sh）' }, { pattern: /wget\s+[^|]+\|\s*(ba)?sh/, reason: '远程代码执行（wget | sh）' }, { pattern: /chmod\s+777/, reason: '设置全权限（chmod 777）' }, { pattern: /\bsudo\b/, reason: '提权操作（sudo）' }, { pattern: /dd\s+if=\/dev\/zero/, reason: '磁盘写入操作' },
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
js { pattern: /rm\s+-rf\s+\/\*/, reason: '删除所有根目录文件' }, { pattern: /curl\s+[^|]+\|\s*(ba)?sh/, reason: '远程代码执行（curl | sh）' }, { pattern: /wget\s+[^|]+\|\s*(ba)?sh/, reason: '远程代码执行（wget | sh）' }, { pattern: /chmod\s+777/, reason: '设置全权限（chmod 777）' }, { pattern: /\bsudo\b/, reason: '提权操作（sudo）' }, { pattern: /dd\s+if=\/dev\/zero/, reason: '磁盘写入操作' }, { pattern: /:\(\)\s*\{\s*:\|:&\s*\}\s*;/, reason: 'Fork Bomb' },
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md console.log('用法：'); console.log(' node security-scan.js <task-file.json> # 扫描任务文件'); console.log(' node security-scan.js --stdin # 从 stdin 读取指令'); console.log(' echo "rm -rf /" | node security-scan.js --stdin'); console.log(''); console.log('退出码：'); console.log(' 0 - 安全，无危险命令');
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
js console.log('用法：'); console.log(' node security-scan.js <task-file.json> # 扫描任务文件'); console.log(' node security-scan.js --stdin # 从 stdin 读取指令'); console.log(' echo "rm -rf /" | node security-scan.js --stdin'); console.log(''); console.log('退出码：'); console.log(' 0 - 安全，无危险命令');
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md console.log('用法：'); console.log(' node security-scan.js <task-file.json> # 扫描任务文件'); console.log(' node security-scan.js --stdin # 从 stdin 读取指令'); console.log(' echo "rm -rf /" | node security-scan.js --stdin'); console.log(''); console.log('退出码：'); console.log(' 0 - 安全，无危险命令');
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
js console.log('用法：'); console.log(' node security-scan.js <task-file.json> # 扫描任务文件'); console.log(' node security-scan.js --stdin # 从 stdin 读取指令'); console.log(' echo "rm -rf /" | node security-scan.js --stdin'); console.log(''); console.log('退出码：'); console.log(' 0 - 安全，无危险命令');
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill documentation, examples, warnings, and operational instructions are presented only in Chinese, with no indication that another language is supported or that the user can opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
At L021, the documentation states a clear intent boundary: TDR is not default behavior and should only trigger when the user says 'use TDR'. However, L049-L064 and L065-L080 describe recommended automatic planning and scheduled heartbeat execution, which operationalize autonomous workflow advancement beyond that stated trigger condition. This is an intent/documentation contradiction rather than mere incompleteness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file switches into Chinese at the main description header and continues in Chinese throughout the skill instructions. This imposes a specific language on users without any stated opt-in, alternative language option, or explanation that the skill is intended only for a Chinese-speaking or region-specific context.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The skill documents an automatic execution path that runs tasks based on task configuration without an explicit per-run user approval gate. In the context of a code-writing and file-operating agent workflow, this can enable autonomous modification of files and execution of multi-step actions that the user may not have directly reviewed, increasing the risk of unsafe or unintended changes.
- Content
bash # 自动执行（按任务配置的 flow 字段） node scripts/auto-execute.js task-001 # 手动指定流程 node scripts/auto-execute.js task-001 --flow full
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The manual
--flow fullinvocation still describes a direct execution command for a task in a system designed to generate code, run tests, and perform file operations. Even though this is a CLI example, it normalizes autonomous task execution and could be used to bypass interactive review expectations, especially because the broader skill promotes iterative self-directed execution.- Content
node scripts/auto-execute.js task-001
手动指定流程
node scripts/auto-execute.js task-001 --flow full
text ---
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON config uses Chinese-only role/model descriptions and behavior notes throughout, with no indication that users can opt into another language or that the skill is intentionally region-specific. That creates a natural-language locale policy concern because the configuration appears to impose a specific language by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file-level description and usage text are written only in Chinese, and later user-facing status/error messages continue this enforced locale. For a general-purpose script, this is a natural-language locale policy issue because users are not given an English or configurable alternative, and the file does not state that the tool is intentionally limited to a Chinese-speaking environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script deletes a path derived directly from the user-supplied task_id using
rm -rf "$lock_dir"without validating that the identifier is constrained to a safe format or that the resolved path remains under the intended tasks directory. An attacker who can supply crafted values such as path traversal segments could potentially cause deletion of arbitrary directories with a.lock.dsuffix outside the expected scope, making this a real filesystem safety issue.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code advertises a substantive audit of instruction adherence, code quality, test validity, and security, but the actual implementation only checks for the presence of task metadata and whether the last execution status was failed. Because it treats successful execution as a proxy for acceptance and performs no real validation of outputs, tests, or generated files, unsafe or incorrect results can be incorrectly approved and moved forward in the workflow.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The header comment describes this script as a 'fully automated' version that automatically calls Sonnet, creates tasks, and starts execution with no human intervention. In reality, planWithSonnet returns a manual handoff object and the main flow instructs the user to copy a prompt into another session and rerun the script, which directly contradicts the documented intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The planning prompt explicitly instructs the model to '使用中文描述', which forces a specific language choice. This is a natural-language locale policy issue because the script does not provide opt-in, fallback, or any documented justification that the skill is intended only for a Chinese-language environment.
- Content