T09 · Insecure Skill Coding Practices
Error
- Location
scripts/package_skill.py:146- Finding
Symbolic Links Can Include Files Outside the Skill Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
skill-studio
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly purpose-aligned, but its packager can persistently install or replace agent skills and has unsafe packaging behavior that can copy files outside the skill directory.
Install only if you trust the publisher and understand that the packaging script can write persistent skill files for multiple agent clients. Do not run package_skill.py on untrusted skill directories until symlink handling is fixed and validation fails closed; review --target use carefully because it can replace existing installed skills.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package_skill.py:84- Finding
Packaging Continues When Validation Is Missing or Cannot Run
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
该代码块的主要功能是对已有 skill 目录进行静态质量审计：解析 SKILL.md frontmatter，检查名称、description、正文内容、references 目录引用、scripts 语法、pycache、空目录与 .gitkeep 等，并以文本或 JSON 输出病灶报告。虽然声明中提到“诊断”与“审计 skill”，这与代码部分吻合，但声明的核心范围明显更大，尤其是“生成 Agent Skill”“架构”“起草”“校验”“打包”以及“5种设计模式”方法并未在此代码中实现。代码的实际用途更接近单一的审计器，而不是完整的 skill-studio 元技能流水线，因此属于描述与行为的实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
该代码的核心用途是“诊断/分类/推荐模式”，通过关键词推断或交互问答确定 uncertainty 类型，再映射到 Tool Wrapper、Generator、Reviewer、Inversion、Pipeline，并返回目录建议与组合模式。这与描述中的“诊断”部分一致，但与“生成 Agent Skill”“覆盖诊断→架构→起草→校验→打包”的完整元技能能力不符。代码没有文件生成、模板渲染、skill 打包、校验工件、重构现有 skill 或审计 skill 内容的实现。因此描述明显高于实际行为，属于能力夸大型不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
该描述与代码存在明显不符。代码的核心功能是“初始化 skill 骨架”：校验名称、创建目录、写入 SKILL.md 模板、按 pattern 创建 references/assets/scripts 及少量参考骨架文件。它并没有进行任何实质性的 skill 诊断、架构设计分析、内容起草生成、校验执行或打包操作；校验与打包只是通过打印提示用户稍后运行其他脚本。虽然代码中有若干 pattern（tool-wrapper、generator、reviewer、inversion、pipeline），但这只是目录/模板选择，不等同于“用5种设计模式诊断并生成 Agent Skill”的完整能力。因此其实际行为更像“skill 项目脚手架初始化器”，与声明的高层工作流和能力范围存在实质性偏差。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是“用5种设计模式诊断并生成 Agent Skill”，属于设计/生成/审计工作流层面的能力；而实际代码并未实现设计模式诊断、内容生成、架构起草等功能。它的主功能是本地文件系统操作：调用校验脚本、压缩目录、并复制安装到多个预定义宿主路径。虽然声明中提到‘校验→打包’，与部分行为有轻微相关，但代码缺失声明中的主要能力，且额外执行了未声明的本地安装/部署行为。因此描述与实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该代码的核心功能是验证 skill 文件夹内容是否符合若干规则：检查 frontmatter、名称、描述、依赖格式、SKILL.md 行数、references 引用情况，以及 scripts 下 Python 文件的语法正确性。它不会生成 skill，不会进行所谓‘5种设计模式’分析，也没有实现架构设计、草稿生成或打包逻辑。虽然声明中包含‘校验’，但声明描述的是一个覆盖诊断→架构→起草→校验→打包的综合型元技能，而代码只对应其中很窄的一部分，因此属于实质性描述不符。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Agent 不懂某个库/团队规范 | 怕它不懂规矩 | **Tool Wrapper** | `SKILL.md` + `references/` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Agent 不懂某个库/团队规范 | 怕它不懂规矩 | **Tool Wrapper** | `SKILL.md` + `references/` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Agent 不懂某个库/团队规范 | 怕它不懂规矩 | **Tool Wrapper** | `SKILL.md` + `references/` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Agent 不懂某个库/团队规范 | 怕它不懂规矩 | **Tool Wrapper** | `SKILL.md` + `references/` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Agent 不懂某个库/团队规范 | 怕它不懂规矩 | **Tool Wrapper** | `SKILL.md` + `references/` |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill describes reading references and invoking local scripts that can read, write, package, and install files, yet it declares no explicit tool scope such as allowed-tools or permissions. That creates an authority gap where a host agent may grant broader filesystem or shell capabilities than users expect, increasing the chance of unintended file modification or command execution during skill use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests like creating, refactoring, or auditing a skill, which can cause unintended auto-activation. In a skill that discusses reading SOPs, invoking validators, packaging, and installation, accidental activation can escalate from mere nuisance to unauthorized file operations or workflow hijacking.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage table includes ambiguous examples without clear conditions for when the skill should abstain, making over-triggering likely. Because this is a meta-skill intended to shape or modify other skills, mistaken activation can redirect user workflows, apply the wrong process, or prompt unnecessary file and script actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instruction "面向 Claude 写作" paired with prescriptive writing constraints establishes a fixed language/style policy for outputs, but the file does not offer the user a choice of language or locale. Because the skill content is written in Chinese and presents the style as mandatory, this can violate organizational expectations around user language preference and opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, including headings, explanations, and usage guidance. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Line L55 gives an example where an instruction requiring Chinese takes precedence, expressed as a mandatory output rule ("必须中文"). For a general architecture/reference document, this is a natural-language locale policy constraint without any stated user choice or opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example trigger phrases are broad and overlap with common user requests such as '帮我规划' or '设计系统', which can cause the skill to activate outside its intended scope. In an agent environment, this may route ordinary conversations into a rigid interview flow, causing unintended execution paths, confusion, or interference with more appropriate skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains all user-facing instructions in Chinese, including the title, usage guidance, and examples. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L066 gives a prescriptive example that instructions such as “必须中文” take priority, and the document elsewhere frames these rules as binding SOP guidance. Because the file does not offer opt-in or a user language-selection path, this constitutes a natural-language locale policy constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural-language text. This file’s module docstring, comments, help text, and user-facing messages are Chinese-only, with no opt-in or explanation that the skill is intended exclusively for Chinese-speaking users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file contains natural-language descriptions, prompts, and help text presented exclusively in Chinese, including the module docstring and usage guidance. The policy scope includes language/locale violations in code string literals, and the file does not offer user opt-in for language selection or explain that the skill is intentionally limited to a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module description and all user-facing status/help messages are written in Chinese, which imposes a specific language on users. The file does not provide an opt-in, alternative locale, or justification that this is a region-specific tool, so it violates the language/locale policy for natural-language content in code files.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script claims validation is mandatory, but if validate.py is missing or subprocess execution fails, run_validate returns success and packaging continues. That fail-open behavior allows unvalidated skills to be zipped and installed into agent skill directories, undermining the security gate and increasing the chance that unsafe or malicious content is distributed.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 用当前 python 解释器跑 validate.py py = sys.executable or "python" try: result = subprocess.run( [py, str(VALIDATE_PY), str(skill_path)], capture_output=True, text=True, encoding='utf-8', errors='replace' )
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains user-facing natural-language documentation and runtime messages entirely in Chinese, including the usage and exit-code guidance. Under the policy, forcing a specific language without opt-in is a locale/language policy violation unless the constraint is explicitly justified, which is not present here.
- Content