T09 · Insecure Skill Coding Practices
Warning
- Location
dist/core/memory.js:36- Finding
Caller-Controlled Storage Paths Permit Filesystem Traversal Outside the Intended Memory Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
蜂兵虾将
Security checks for vulnerabilities and agentic risk
Overview
This skill is not outright malware, but it needs review because it stores user behavior and goals persistently while advertising broader autonomous business automation than the code actually delivers.
Review before installing. Use it only if you are comfortable with a local Node package storing behavioral preferences, workflows, personal goals, values, and insights in plaintext files. Run it in a dedicated project directory, avoid passing user-controlled skill names or base directories, back up memory before any reset, and do not expect real scheduled web monitoring or autonomous business execution unless you wire those capabilities separately.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
dist/core/memory.js:141- Finding
Sensitive Behavioral Memory Is Persisted in Plaintext Without Enforced Retention or Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (93)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
该描述将技能包装为可投入使用的行业级自动化AI团队，但代码本质上只是一个“多智能体协作系统演示”。虽然代码确实体现了多智能体、自主决策、协作和动态加载能力这些概念，但与声明中的核心业务能力存在明显差距。代码没有外部数据采集、没有内容创作引擎、没有真实预测模型、没有定时触发、没有报告产出，也没有自动执行业务动作。其主要目的不是提供生产级热点监控/赚钱助手，而是展示多智能体架构思想。因此描述与实际行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description markets a broad autonomous business system with four agents that monitor the whole web, create content, generate trend insights, record work automatically, adapt to users, and issue scheduled reports. The code shown is a demonstration script only. It exercises library APIs with static sample data and prints formatted console output. While there is some overlap with 'trend insight' and 'work logging/knowledge capture' themes, the actual chunk does not show network collection, content generation, task automation, scheduling, trigger handling, or autonomous multi-agent coordination. Therefore the declared description materially overstates and misrepresents what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declaration advertises a full autonomous multi-agent business team with external monitoring, strategy generation, prediction, automation, and scheduled reporting. The actual code shown is a TypeScript declaration for a memory subsystem. It defines data types and methods for managing layered memory (context, variables, L1-L4 persistence, querying, archiving, syncing across systems, and generating reflective insights from stored data). While such memory functionality could be a supporting component of a larger agent system, this code chunk does not implement the advertised primary capabilities, nor does it show triggers, web collection, content creation, report scheduling, or execution logic. Therefore the description materially overstates and misrepresents what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description promises a broad autonomous multi-agent business operations system spanning monitoring, content generation, trend insight, and automatic execution across industries. The code chunk, however, is a standalone memory subsystem. It only manages hierarchical memory state on disk, performs archival/query operations, exposes health/status summaries, and generates lightweight observations from stored records. While such memory could support a larger agent system, this code does not itself implement the declared headline capabilities, triggers, or automation behavior. Therefore the description materially overstates and misrepresents what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Yes, this is a clear mismatch. The description claims a full-featured multi-agent operational system with broad monitoring, analysis, automation, and scheduled report generation across industries. The provided code chunk does not implement any of those capabilities; it is effectively empty and contains only an empty export in a declaration file. Therefore the declared purpose is not accurately represented by the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description promises a production-like multi-agent system with broad autonomous capabilities: web-wide monitoring, content generation, trend forecasting, auto-execution, adaptive routing, proactive sensing, automatic reporting on a schedule, and applicability across many industries. The actual code chunk does not implement or demonstrate those behaviors. It is an example script that imports AICollaborationSystem, constructs it, passes static in-memory sample data into methods like dailyScan, dailyWorkflow, dailyGoalTracking, generateInsight, healthCheck, and getSummary, then logs results. There are no triggers, schedulers, network/data-collection operations, content publishing/creation flows, external integrations, or autonomous actions visible in this chunk. The primary purpose of the code shown is illustrative/demo usage of an internal system API, which is materially narrower than the declared end-user functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description markets a full autonomous multi-agent business system with internet-scale monitoring, content production, forecasting, scheduled reporting, and proactive execution. The supplied code chunk is only a declaration file defining an aggregate class and exported subsystems: memory, signal recognition, workflow assets, and personal goals. Its methods suggest internal coordination and tracking capabilities, but there is no evidence in this chunk of network collection, content generation, report scheduling, industry-specific automation, or the named four-agent behavior. Because the description promises materially broader and different functionality than what the code demonstrates, this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description promises a broad autonomous multi-agent business system with internet-scale monitoring, content production, trend prediction, automatic execution, and scheduled reporting across all industries. The supplied code chunk is only a main export/integration layer wiring together memory, signal, workflow, and goal subsystems, with convenience methods for generating reports from caller-supplied data. It does not itself demonstrate network collection, scheduling, autonomous action, or the advertised advanced behaviors. Additionally, the code exposes personal goal tracking and self-awareness reporting, which is a different emphasis from the marketed business hot-topic/content automation description. This is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description markets a broad autonomous business-growth agent team with web monitoring, content creation, trend insight, smart routing, proactive sensing, and scheduled reporting. The supplied code chunk instead exposes TypeScript declarations for a PersonalGoalSystem. Its methods analyze motivation, connect goals, compare actual vs ideal energy allocation, find blind spots, generate an AI mirror letter, predict future self states, and create a weekly self-awareness report. There is no evidence of network collection, content production, business trend monitoring, autonomous execution, user-intent routing, or scheduled triggers. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a multi-agent business automation product covering cross-industry hotspot monitoring, content creation, trend prediction, proactive execution, adaptive routing, and automatic scheduled reports. The supplied code instead implements a 'PersonalGoalSystem' focused on self-reflection: motivation analysis, goal network construction, time/energy allocation analysis, blind-spot detection, AI mirror letters, future-self prediction, and weekly self-awareness reports. While there is a small prediction/reporting element, it is about personal goals rather than industry trends or monetization opportunities. There is no evidence of web collection, content production, market monitoring, scheduling, autonomous execution, or the named four-agent architecture. This is a strong description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The declared description presents a broad, multi-agent autonomous platform covering collection, creation, prediction, execution, adaptation, and scheduled reporting across industries. The supplied code chunk is much narrower: it exposes a SignalRecognitionSystem focused on evaluating signals, adding them to memory, querying them, identifying patterns, generating a daily scan report, and syncing with other systems. Those behaviors are compatible with a monitoring/analysis component, but they do not substantiate most of the headline claims. Because the actual code’s primary scope is a limited signal-analysis subsystem rather than the full described autonomous multi-agent product, the description materially overstates the implemented behavior in this chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description promises a comprehensive autonomous multi-agent system covering collection, creation, prediction, automatic execution, adaptation, and scheduled reporting across industries. This code chunk does not implement those headline capabilities. Instead, it is a focused internal analysis component for classifying and storing already-provided signals, producing a simple report, detecting basic patterns, and syncing memory entries to other systems. While 'trend insight' or signal analysis loosely overlaps with the description, the primary behavior here is much narrower and lacks many of the declared core functions. Therefore the declared description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a comprehensive multi-agent automation product with industry-wide monitoring, content creation, trend insight, adaptive autonomous execution, and fixed-time automatic reporting. The actual supplied code chunk is much narrower: it exposes type definitions for a workflow asset/knowledge system that organizes tacit knowledge, capability genes, methodologies, and daily workflow reports. There is no visible implementation for collecting internet data, generating content, forecasting trends, recognizing intent, routing among agents, proactively sensing anything, adapting to users, or triggering reports on a schedule. While 'generateDailyWorkflowReport' loosely overlaps with reporting, it does not substantiate the broader claims or the specific timing behavior. Therefore the description materially overstates and misrepresents the code's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个功能非常广泛的自动化多代理业务系统，核心卖点是监控、创作、预测、执行和定时报告。实际代码仅围绕工作复盘与知识管理：从 userResponses 中提取 operation/experience/decision/thinking/value 五层知识，存入 memory；从 decision 和 thinking 提炼“能力基因”；再汇总生成“工作方法论”并写入 L3；另提供查询和向 signal、goal 系统同步的方法。这与声明的主要用途存在实质性偏差。虽然“自动记录”与知识沉淀有一点点关联，但不足以覆盖其宣称的主要能力，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description promises a comprehensive autonomous multi-agent business automation system with broad cross-industry applicability and scheduled reporting. The supplied code instead behaves like a console demonstration for a specific holiday duty mechanism: it initializes an AI collaboration system, stores methodology records, evaluates manually defined hotspot examples, classifies them by attention score, and prints workflow/report templates. While there is partial thematic overlap around hotspot monitoring and reporting, the actual code is much narrower and lacks most of the headline capabilities in the description. Therefore the description materially overstates and misrepresents the implemented behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description promises a comprehensive multi-agent business automation skill with broad capabilities and autonomous operation across industries. The actual code chunk is much narrower: it is explicitly labeled as a scenario example, not a standalone system, and demonstrates hotspot evaluation/report generation over mock inputs using an imported system. While it loosely aligns with 'hotspot monitoring' and 'reporting,' it does not substantiate most of the headline claims such as all-web collection, content creation, trend prophecy, automatic execution, scheduled triggers, or adaptive multi-agent routing/reflection. This is a material description-to-behavior mismatch because the declared primary purpose and capabilities are significantly broader and more autonomous than what the code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a broad, production-like multi-agent business automation system with monitoring, generation, forecasting, adaptation, and scheduled reporting across industries. However, the provided code chunk does not implement those behaviors; it only installs dependencies, builds TypeScript, prepares local directories, and runs an example/test script. While installation/setup code can be a supporting component, this chunk by itself materially differs from the declared operational purpose and does not evidence the advertised capabilities or triggers.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared description promises a comprehensive autonomous AI workforce with four specialized agents, cross-industry monitoring, content creation, trend insights, smart routing, adaptation, and scheduled automated reports. The actual code only demonstrates a memory/knowledge management design via console logs and hardcoded sample data. Its real focus is scenario-specific memory entries, metadata, usage feedback, scoring, and illustrative APIs. Even where terms like 'smartQuery' or 'recordUsage' appear, they are mostly printed examples rather than functioning integrated capabilities. The only actual computation is a simple filter/sort over in-memory sample entries. Therefore the primary purpose is materially different and substantially narrower than declared.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description promises a comprehensive multi-agent business automation product with cross-industry monitoring, content generation, trend insight, autonomous execution, adaptive intelligence, and scheduled report delivery. The actual code chunk does not implement those core functions. Instead, it mainly demonstrates a specific information freshness/time-decay policy: assigning decay rates based on publish date, downgrading older items, filtering default-visible news to the most recent 7 days, sorting by recency, and saving this configuration into memory. While this could be a small supporting component of a larger monitoring system, on its own it materially differs from the declared primary purpose and lacks the headline capabilities claimed in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description markets a comprehensive autonomous multi-agent business system with web-wide monitoring, intelligent routing, reflection, proactive perception, adaptation, forecasting, content generation, and scheduled automated reporting. The supplied code chunk is much narrower: it is a demo script for evaluating predefined hotspot objects, generating formatted console output, and storing/querying data in a local memory abstraction. Its primary purpose is hotspot scoring/reporting demonstration, not an end-to-end autonomous all-industry AI workforce. The mismatch is material because several headline capabilities in the description are absent from the code, especially web collection, scheduling, trend prediction, and automated execution.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a multi-agent business automation skill for cross-industry monitoring, content creation, predictive trend analysis, and automatic report/execution. This file instead implements a personal self-reflection and goal-tracking system that analyzes motivation, energy allocation, blind spots, and weekly self-awareness, which is a materially different behavior from the advertised business-oriented AI team.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest claims an AI team that performs whole-network collection, content creation, trend forecasting, smart routing, proactive sensing, user adaptation, and automatic execution with scheduled reports. This document instead presents a local personal growth and knowledge-management system focused on memory storage, signal scoring, workflow asset capture, and personal goal tracking, with no concrete implementation of autonomous multi-agent execution or content generation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The reset instructions include a destructive rm -rf command without a prominent warning that it permanently deletes stored memory data. In this skill, the memory directory is explicitly positioned as long-term storage for user context, history, and logs, so accidental execution can cause irreversible loss of potentially valuable or sensitive data.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The documented rm -rf memory/my_system/ command is a destructive shell operation that can be abused or misapplied, especially if users adapt it with variables or run it from the wrong directory. In an agent-skill ecosystem, normalizing direct execution of such commands increases the risk of catastrophic data deletion and can become more dangerous if copied into automated tooling or executed with elevated privileges.
- Content
A：
bash # 删除记忆目录 rm -rf memory/my_system/ # 重新创建系统 const ai = new AICollaborationSystem('my_system');
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill prompt and usage guide are written only in Chinese, and no part of the document offers a language choice or states that the skill is intentionally limited to Chinese-speaking users or a China-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.