T09 · Insecure Skill Coding Practices
Error
- Location
scripts/organize_workspace.py:511- Finding
Arbitrary Python Code Execution Through Unsafe Configuration Loading
- Content
View full analysis
- Remediation
View remediation
Security audit
color-filer
Security checks for vulnerabilities and agentic risk
Overview
This is a real folder-organizing skill, but it includes unsafe Python configuration execution and broad file-changing behavior that users should review carefully before installing.
Install only if you are comfortable running local scripts that can recursively rename, move, and copy files. Use dry-run first, avoid `--yes`, run only on a small backed-up workspace, and do not use `--config` with any file you did not personally inspect because it is executed as Python code.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/organize_workspace.py:128- Finding
Filesystem Safety Validation Can Be Bypassed Through Symbolic Links and Incomplete Denylisting
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze_folder.py:229- Finding
Analyzer Advertised as Read-Only Can Overwrite a File Outside the Analyzed Directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill presents itself as a naming/color-classification utility, but the documented behavior includes bulk moving files, creating directories, renaming directories, and loading external configuration via exec. That mismatch is dangerous because users may grant trust to a seemingly cosmetic organizer while it actually has powerful filesystem modification and code-execution semantics, enabling arbitrary code execution through a supplied config file and large-scale data changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill presents itself as a naming/color-classification utility, but the documented behavior includes bulk moving files, creating directories, renaming directories, and loading external configuration via exec. That mismatch is dangerous because users may grant trust to a seemingly cosmetic organizer while it actually has powerful filesystem modification and code-execution semantics, enabling arbitrary code execution through a supplied config file and large-scale data changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill presents itself as a naming/color-classification utility, but the documented behavior includes bulk moving files, creating directories, renaming directories, and loading external configuration via exec. That mismatch is dangerous because users may grant trust to a seemingly cosmetic organizer while it actually has powerful filesystem modification and code-execution semantics, enabling arbitrary code execution through a supplied config file and large-scale data changes.
- Content
exec() call detected
High
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The script builds a Python filename from user-controlled --config input and executes the file contents with exec(..., globals()). That enables arbitrary code execution in the context of the user running the tool, which is far beyond a folder-coloring/organization skill and is especially dangerous because the script already performs filesystem modifications.
- Content
python config_file = os.path.join(os.path.dirname(__file__), f'{args.config}_config.py') if os.path.exists(config_file): print(f'📋 加载配置: {args.config}_config.py\n') exec(open(config_file, encoding='utf-8').read(), globals()) else: print(f'⚠️ 配置文件不存在: {config_file}') print('⚠️ 跳过目录重命名和文件归档步骤\n')
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Executing arbitrary Python from a configuration file materially expands the skill's authority from organizing files to unrestricted code execution. In the context of a workspace-management skill, that mismatch is dangerous because users may trust the tool with broad filesystem access, making abuse highly consequential.
- Content
Direct flow: open (file read) → exec (code execution)
High
- Category
- Data Flow
- Confidence
- 99% confidence
- Finding
This is a direct file-read to code-execution flow: the script opens a config file and immediately passes its contents to exec. Any attacker who can influence the config name or place a crafted config file in the expected directory can run arbitrary Python code, leading to file tampering, credential theft, or command execution under the current user's privileges.
- Content
python config_file = os.path.join(os.path.dirname(__file__), f'{args.config}_config.py') if os.path.exists(config_file): print(f'📋 加载配置: {args.config}_config.py\n') exec(open(config_file, encoding='utf-8').read(), globals()) else: print(f'⚠️ 配置文件不存在: {config_file}') print('⚠️ 跳过目录重命名和文件归档步骤\n')
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents and encourages filesystem read/write operations, including batch rename, move, create-directory, and backup behavior, but the manifest does not declare a restrictive tool scope such as permissions or allowed-tools. In an agent environment, missing explicit scope weakens policy enforcement and can let the skill be invoked with broader file access than users expect, increasing the chance of unintended destructive changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description and nearly all user-facing instructions are written in Chinese, and the troubleshooting section specifically discusses Chinese character display, indicating an implicit Chinese-only usage expectation. The file does not offer an alternative language or state that the locale restriction is optional or justified for a region-specific tool.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template's metadata and all user-facing headings/content are written in Chinese, indicating the skill will generate output in a fixed language. The file does not offer a language choice or document that the skill is intentionally limited to a Chinese-language context, which violates the locale-choice policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's natural-language comments, console messages, usage text, and generated report content are all written in Chinese, and the script does not provide any mechanism for users to select another language. This can violate a language/locale policy when a skill is expected to be locale-neutral or user-selectable unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language instructions, warnings, prompts, and help text that force a specific language for all users. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific; neither is present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Manifest 描述强调通过 emoji 色块和补零命名规则进行可视化文件管理，而本脚本除重命名外还实现了完整目录备份、批量创建目录以及按规则归档移动文件。虽然这些功能与整理相关，但已超出“颜色标注与命名规范”这一较窄表述，属于更广泛的工作区重组操作。
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python return None def confirm_operation(dry_run, auto_confirm=False): """用户确认操作""" if dry_run: return True
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python return None def confirm_operation(dry_run, auto_confirm=False): """用户确认操作""" if dry_run: return True
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python return None def confirm_operation(dry_run, auto_confirm=False): """用户确认操作""" if dry_run: return True
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python return None def confirm_operation(dry_run, auto_confirm=False): """用户确认操作""" if dry_run: return True
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
rename_directories、create_directories 和 move_files 实现的不是单纯的颜色标注或命名标准化，而是对工作区结构进行实际重组，包括目录改名、目录创建和文件迁移。这样的结构性整理超出了 manifest 中对 emoji 标注和排序规则的核心承诺。
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该模板位于
color-filer技能中，但文案明确写明“本页由folder-organizer技能自动生成”，这会让使用者对实际负责生成内容的技能产生误解。虽然这不是代码执行层面的风险，但属于文档/模板意图与所属技能不一致的明显矛盾。- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
文件尾注再次声明该索引由
folder-organizer自动维护，这与当前技能清单中的名称color-filer相冲突。此类文档级矛盾会误导审计者和用户对技能真实职责的理解，符合意图-代码/文档分歧。- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file is natural-language documentation, and it appears to require Chinese language comprehension throughout. The policy requires flagging language or locale constraints when a specific language is forced without user opt-in or a clear documented justification.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes a skill for folder color labeling and naming规范, which suggests organizing or analyzing names and categories. This script not only analyzes the directory but also creates a new report file on disk (
folder_analysis_*.md), which is a side effect not stated in the description of visual classification and naming rules.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The module docstring is written entirely in Chinese and does not indicate any language choice or opt-in. Under the policy criteria, natural-language instructions or documentation that effectively require a specific language can be a locale/language policy issue when no user choice is offered.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The docstring and printed message describe this file as an example script for 'folder-organizer', which directly conflicts with the surrounding skill context identifying the skill as 'color-filer'. This is an intent/documentation mismatch rather than an implementation issue, but it can mislead reviewers about the script's intended purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script's docstrings, CLI description, help text, warnings, and runtime messages are all presented in Chinese, with no indication that users may select another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This Python file contains user-facing print strings, comments, and docstrings entirely in Chinese, with no indication that the user can choose another language or locale. Per the policy, forcing a specific language without opt-in is a natural-language policy concern even in code files when user-visible text is affected.
- Content
Static analysis
No suspicious patterns detected.