T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:212- Finding
Overbroad cleanup can delete unrelated user files
- Content
View full analysis
- Remediation
View remediation
Security audit
巴厘岛旅游资源解析入库
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate Bali travel-resource import purpose, but it can rewrite production CSVs and delete broad sets of files without enough safeguards.
Install only after reviewing the workflow with an operator. Use a dedicated empty staging directory, keep backups of production CSVs, require dry-run/schema validation before writes, avoid the cleanup step unless it deletes only files created in the current run, and do not enable Redis or public web enrichment unless those integrations are explicitly needed and configured safely.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:44- Finding
Third-party components are installed without version or integrity verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/append_to_csv.py:89- Finding
Production CSV files can be silently corrupted or truncated during import
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/broadcast_redis.py:30- Finding
Redis update metadata can be transmitted without authentication or encryption
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description promises a resource-ingestion skill that activates for supplier document parsing and mandates pre-checking same-type CSV headers to ensure exact consistency with production before insertion. The supplied code only implements a CSV append utility: it takes an input CSV, resolves target/template paths, warns on missing required fields, and writes rows to the target CSV. Although it references template files, it never reads template headers or compares them with input columns, so the central schema-alignment requirement is not implemented. It also does not handle PDF/Word parsing at all, despite that being a key declared use case. Additionally, the description mentions possible gbk or utf-8-sig encodings, but the code uses utf-8-sig only. These are material gaps in primary purpose and capabilities, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on a resource-ingestion workflow: receiving supplier documents, parsing tourism resource content, checking matching CSV headers (including gbk or utf-8-sig encodings), and then writing conformant records for 8 resource classes. The supplied code does none of that. Instead, it defines a command-line tool that connects to Redis and publishes update notifications to a stream named 'resource_stream'. While the supported resource categories overlap with the declared 8 classes, that overlap is superficial; the primary purpose is materially different. The Redis broadcast capability is undeclared, and the expected ingestion/parsing/storage behaviors are absent. Therefore this is a clear description-behavior mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill describes file read/write and environment-capable operations but does not declare an explicit tool scope or permission boundary. In practice this increases the chance that an agent executing the skill will access or modify files more broadly than intended, especially because the workflow includes reading local production CSVs, downloading files, and deleting files from a target directory.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation says only contract files should be downloaded, but then instructs downloading all uncertain files. In a cloud-drive context this can lead to over-collection of unrelated or sensitive files, increasing exposure and violating least-privilege expectations for data retrieval.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly authorizes enriching records with public network information beyond the supplier contract. That expands the data collection scope, can introduce untrusted external data into a production library, and may cause privacy, provenance, or integrity issues if operators assume the import is contract-faithful.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Allowing unrelated public network data for a document-to-CSV import widens the skill's effective authority beyond its core purpose. This creates a channel for scope creep, contaminated datasets, and unintended external lookups that may violate user expectations or internal handling rules for controlled supplier content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cleanup step instructs deletion of all non-result files in the target directory, including downloaded contracts and any other files present, without requiring explicit user confirmation at execution time. If the target path is broad or mis-specified, this can destroy unrelated user data and erase source artifacts needed for audit, rollback, or dispute resolution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring, usage text, and examples are presented entirely in Chinese, and the CLI help/console output throughout the script also assumes Chinese-only interaction. For a general-purpose script, this is a natural-language locale restriction without user opt-in or an explicit justification that the tool is region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script can write directly to a default production-like CSV directory when --target is omitted, but it does not enforce the SOP requirement to first retrieve and verify the existing header format before appending. In this skill context, that creates a real integrity risk: malformed or schema-mismatched records may be silently merged into production data, causing corruption of operational resource libraries.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a SOP for parsing supplier documents and importing Bali travel resources into CSV/production formats, with an emphasis on matching existing CSV headers before writing. This script instead connects to Redis and publishes resource update events to a stream, which is a separate notification/integration behavior not described in the skill’s stated purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
For a skill described as document parsing and CSV-based resource import, opening a Redis connection via environment-configured host/port and broadcasting events is not an obvious or declared requirement. This adds an integration capability beyond local parsing and data entry, making the skill capable of interacting with external infrastructure unrelated to the manifest text.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill directs access to Google Drive content and local production libraries without a clear privacy notice or explicit access-consent boundary. While common in ingestion workflows, this still creates a real risk of reading sensitive business documents and local datasets without sufficiently transparent user warning.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The docstring states the search order is CLI template first, then production library CSV with wording suggesting it is a fallback when references lack a CSV. However, the implementation checks the production-library path before the skill's built-in references every time, so the documented intent does not match the actual lookup behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and CLI help text are written in Chinese, and all user-facing descriptions in the script follow that single locale. Under the policy rule, forcing a specific language without user opt-in or justification is a natural-language policy issue.
- Content