T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/md_to_xmind.py:135- Finding
Predictable Shared Temporary Directory Enables Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
testcase-creator
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent, but its optional XMind converter uses an unsafe shared temporary folder that could overwrite or remove local files in some environments.
Review before installing if you plan to use XMind conversion, especially on shared machines or automation accounts. The Markdown-only workflow is straightforward, but the converter should be changed to use a unique secure temporary directory before it is trusted for sensitive or multi-user environments. Also treat requirement document URLs as private data access because the skill may read or download their contents.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个测试用例生成技能，核心职责应是读取/处理需求相关文档并产出测试用例内容，必要时再生成 XMind 格式输出。该代码片段实际只负责辅助性的文件命名与输出目录创建，属于支持性实现细节，但如果将其作为对整个技能描述的实际行为代表，则与声明的主要目的明显不符。尤其是它完全不包含文档解析、测试用例编写、Markdown 内容生成或 XMind 文件生成逻辑。此外，代码总是返回 md 和 xmind 两种文件路径，这与声明中“仅在用户明确要求时额外生成 XMind”也不一致。因此应判定为描述与代码行为不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description states the skill generates test case documents in Chinese-language markdown by default and the entire instruction set enforces Chinese formatting conventions, but it does not provide any user opt-in or language selection. This can violate language/locale policy requirements where skills should not force a specific language unless documented as region-specific or user-selected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may opt into another language. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file title and all guidance are written exclusively in Chinese, and there is no indication that the skill supports other languages or that users can opt into this locale. Under the policy, forcing a specific language without user choice or a documented regional justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains its module docstring and CLI usage/help text entirely in Chinese, which imposes a specific language on users. Under the policy, locale or language constraints should either be optional, user-selectable, or clearly justified as region-specific; no such opt-in or justification is present here.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest frames this skill as generating test case documents from requirement documents, with optional XMind conversion. The instructions additionally tell the agent to fetch content from URLs and, if needed, use other skills to download documents, which introduces external-access capability not explicitly justified by the manifest’s local document-generation focus.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 70% confidence
- Finding
The manifest describes generating Markdown and optionally XMind test case outputs, but does not mention opening an editable result view. Telling the agent to let the user view and edit the generated Markdown introduces an additional interactive editing capability that is not part of the declared scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains natural-language instructions entirely in Chinese, starting from the title, and does not indicate that the skill is intentionally limited to Chinese-speaking users or provide any user opt-in for language preference. Under the policy, forcing a specific language without user choice can be a locale/language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains natural-language instructions solely in Chinese, starting from the title and continuing throughout the template. Under the language/locale policy, forcing a specific language without user opt-in or a documented regional justification is a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language content, including the module description and later user-facing messages, is exclusively in Chinese. This imposes a specific language on users without any opt-in, fallback, or explanation that the tool is intended only for a Chinese-speaking or region-specific context.
- Content