T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:100- Finding
Predictable Plaintext Intermediate File Is Not Securely Deleted
- Content
View full analysis
- Remediation
View remediation
Security audit
质量周会策划技能
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently generates Chinese quality-meeting planning documents from user-provided meeting data, with only minor local-file hygiene and scoping notes.
Install only if a Chinese quality-weekly-meeting DOCX generator matches your need. Use it in a private workspace, avoid placing sensitive meeting links or internal metrics in shared folders, and delete the intermediate meeting_data.json after the DOCX is created.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述包含两个关键能力：1）自动解析多格式输入；2）从用户提供的质量数据和工作问题中提取议题要点并生成方案。实际代码中，入口参数只有--input JSON文件和--output Word文件，读取方式为json.load，随后仅做字段校验并把现成字段写入docx。代码没有看到对PDF、Excel、文本等多格式解析的实现，也没有任何NLP、规则抽取、总结归纳或从原始问题生成议题的逻辑。因此，其真实功能是“根据预先整理好的结构化JSON生成质量周会策划方案Word文档”，与声明中的自动解析和自动提取要点存在实质性差异。除此之外，代码没有发现额外越权能力，主要问题是宣称能力大于实际行为。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
L005 说明“当用户需要策划质量周会、整理质量数据生成会议方案、准备质量会议材料、或组织质量评审会议时使用”，虽然有质量相关限定，但“准备质量会议材料”“组织质量评审会议”仍较宽泛，且没有列出明确触发词或不适用情形。对 manifest/description 而言，这会降低触发边界的清晰度。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
L015 将触发条件表述为“用户提供质量数据/问题并要求生成周会方案、会议策划、会议准备材料”，其中“会议策划、会议准备材料”范围较广，未限定为质量周会场景的具体触发短语或排除条件。这种描述可能导致技能被用于泛化的会议准备请求，而不是仅在预期的质量周会规划场景中激活。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to invoke a local script through a shell command to generate a Word document. Introducing subprocess execution expands the attack surface beyond the stated planning task: if any part of the command, paths, or surrounding execution context becomes user-influenced, it can enable command injection, unsafe file writes, or execution of unintended local code.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains all user-facing instructions and examples exclusively in Chinese, including the title and schema guidance. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
- Content
Static analysis
No suspicious patterns detected.