T09 · Insecure Skill Coding Practices
Warning
- Location
render.py:100- Finding
Configuration-Controlled Skill Name Enables Output Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
house-skills-kit
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a coherent real-estate skill kit, but its generator and installer have local file-boundary flaws that users should review before installing.
Review before installing. Only run render.py and install.sh on configurations and generated skill directories you trust, inspect generated SKILL.md and manifest.json before installation, avoid rendering untrusted YAML, and verify all tax, loan, and policy outputs against current official sources before using them for real transactions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
install.sh:86- Finding
Unvalidated Manifest Entry Allows Arbitrary Local File Hashing
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (81)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This overview advertises business-domain real-estate skills, but also includes instructions for generating branded skills and installing them into local agent directories via
install.sh. That introduces system-level file write/installation behavior not clearly scoped in the metadata, which can mislead users into invoking a skill expecting advisory content while it performs local environment modification.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This overview advertises business-domain real-estate skills, but also includes instructions for generating branded skills and installing them into local agent directories via
install.sh. That introduces system-level file write/installation behavior not clearly scoped in the metadata, which can mislead users into invoking a skill expecting advisory content while it performs local environment modification.- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python try: from ruleengine import get_rules as _gr rules, _ = _gr("loanterm", city=city) return rules except Exception: return {}
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python try: from ruleengine import get_rules as _gr rules, _ = _gr("loanterm", city=city) return rules except Exception: return {}
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python try: from ruleengine import get_rules as _gr rules, _ = _gr("loanterm", city=city) return rules except Exception: return {}
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python try: from ruleengine import get_rules as _gr rules, _ = _gr("loanterm", city=city) return rules except Exception: return {}
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python try: from ruleengine import get_rules as _gr rules, _ = _gr("loanterm", city=city) return rules except Exception: return {}
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python try: from ruleengine import get_rules as _gr rules, _ = _gr("loanterm", city=city) return rules except Exception: return {}
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This file contains multiple natural-language statements such as the Chinese title and branding text like "中文房产 AI" and "中文精选列表" that position the skill and publishing flow around a single language/locale. Under the policy, forcing or assuming a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README describes the repository as a Chinese real-estate AI skill set and explicitly emphasizes it as a Chinese-language toolkit, which amounts to a language/locale constraint in the skill description. There is no indication that users may opt into another language or locale, nor a documented justification limiting the skill to a region-specific compliance scope.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation text is extremely broad—covering installation, usage, generation, and role-based selection for essentially any real-estate-related AI skill request. Overbroad matching can cause this skill to activate in contexts where it is not the best fit, increasing the chance that users are routed into installation/generation flows or exposed to unrelated capabilities without clear intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The top-level description is written as a Chinese-only usage directive and presents the skill as oriented to Chinese-language interaction, without indicating that the user may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill documentation is written only in Chinese, including headings and operational instructions, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file’s user-facing natural-language content, field values, and examples are entirely in Chinese, and there is no indication that the user can choose another language or that the locale restriction is explicitly documented as a justified regional constraint. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger list is very broad and consists of common real-estate terms such as '买房', '新房', '小区', and '房源'. This can cause the skill to activate in routine conversation outside the user's intended scope, leading to unintended routing, over-collection of context, or inappropriate tool/skill invocation in adjacent housing discussions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes generic real-estate shopping terms such as '湖景房', '买房', '售楼处', '认筹', '户型', and '价格', which are common across many unrelated property queries. This can cause the skill to activate outside its intended project scope, increasing the chance of misrouting users into branded sales flows, collecting leads inappropriately, or presenting project-specific claims when the user did not ask for this development.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger keywords include broad, everyday housing phrases such as '买房', '找房', and '看小区' without clear constraints on user intent, geography, or workflow stage. This can cause the skill to activate too broadly, leading to unintended invocation in unrelated conversations and increasing the risk of over-collection of context or steering users into sales/conversion flows they did not explicitly request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file includes its primary natural-language documentation and usage text only in Chinese, which effectively forces a specific language for users interacting with the skill. Under the policy, language constraints should offer user choice or be clearly documented as justified; neither is present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The quick-start section encourages immediate use of calculators while the critical caveat that all policy rules are only demonstration data appears much later under '已知边界'. For a real-estate finance/tax tool, users may act on incorrect tax, loan, or qualification outputs, causing financial loss or compliance mistakes because the warning is not prominent at the point of use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description uses broad trigger wording such as '用户问房贷月供、买房税费、新房交房费用、楼层差价或折扣叠加测算', which can cause the agent to invoke this skill for loosely related housing-finance queries without a tight boundary. Over-broad invocation criteria increase the chance of inappropriate routing, misleading financial output, or unnecessary exposure of user financial details to a tool when a simpler conversational answer would suffice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's natural-language interface is entirely in Chinese, including the module description, CLI help text, runtime output, and error messages. This imposes a specific language/locale on users without any opt-in or configurable alternative, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file contains extensive natural-language instructions and output text exclusively in Chinese, including the module docstring and CLI help context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file embeds all user-facing instructions and descriptions in Chinese, including the main module docstring and command help text context, which effectively forces a specific language for users. The policy requires flagging language or locale constraints when the skill does not offer a language choice or clearly justify the restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python skill is a code file, so SQP-3 applies. The natural-language strings present the tool entirely in Chinese and the CLI description also fixes the language, with no opt-in, alternate locale, or justification that the skill is strictly region- or locale-bound; this can violate a language/locale policy requiring user choice.
- Content