T09 · Insecure Skill Coding Practices
Error
- Location
scripts/forge.py:688- Finding
Path Traversal Enables Arbitrary Directory Replacement or Recursive Deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Trace
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent persona-generation purpose, but it automates downloads, dependency installation, file writes, and deployment into another skill with insufficient user review and contains real filesystem and prompt-persistence risks.
Review this skill carefully before installing. Use it only in a sandbox or disposable workspace, manually approve any web search, downloads, dependency installation, and deployment step, and do not let an agent auto-answer overwrite prompts. Treat generated personas from web content as untrusted until you inspect the extracted memories and universal_prompt.txt.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/forge.py:824- Finding
Untrusted Collected Text Is Persisted as Executable Agent Prompt Content
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:66- Finding
Automatic Installation of a Mutable Third-Party Search Skill
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (35)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README describes automatic downloading, file creation, dependency changes, and deployment with language such as "自动完成，无需等待," but does not present these as sensitive, system-modifying operations requiring explicit consent. This weakens user awareness and safe-agent controls, making it easier for the skill to perform impactful actions without informed approval.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to auto-install another skill from SkillHub if a search capability is missing, which expands privileges and functionality at runtime without user approval. Auto-installing dependencies from an external hub introduces a supply-chain risk and allows the skill to alter the execution environment beyond its declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The documented behavior extends beyond the stated description by including local/PDF parsing, character extraction, web acquisition, and deployment-related actions that are not clearly declared as part of the skill's contract. This mismatch can mislead users and orchestrators into granting trust or capability under false assumptions, increasing the risk of unintended data access or side effects.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow explicitly states that downloading, file writes, package generation, installation, and deployment should occur automatically without waiting for user confirmation. This is dangerous because it permits high-impact side effects and persistence actions to happen from a single prompt, with no opportunity for the user to review sources, destinations, or scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that generated packages may be deployed into another skill's runtime directory, creating cross-skill side effects and persistence outside this skill's own workspace. Writing into another component's active runtime area can change behavior unexpectedly and increases the blast radius of any malformed or malicious generated content.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README defines a trigger that initiates a multi-step workflow including web search, downloading images/audio, writing files, generating artifacts, and deploying them without additional confirmation. This exceeds the stated high-level purpose of personality extraction/package generation and creates a risky automation chain where untrusted external content and system modifications occur automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "帮我复刻XX" is broad and natural-language-like, making accidental activation plausible during ordinary conversation. Because the triggered workflow includes network activity, downloads, file writes, and deployment, an overly permissive trigger materially increases the chance of unintended execution.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents file read/write behavior but does not declare any tool scope, permissions, or allowed-tools boundaries. That creates an authorization ambiguity where an agent may perform filesystem operations without explicit least-privilege constraints or user awareness.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is described as generating SoulPod packages, but it also deploys output into another skill's runtime directory (
inhabit/personas/). Writing into another component's active runtime broadens the trust boundary and can enable persistence, tampering, or unintended execution/use by downstream systems.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase is broad enough that a simple request like '帮我复刻XX' can initiate a multi-step workflow involving search, downloads, writes, and deployment. Overbroad triggers increase the chance of accidental activation and make it easier for indirect or ambiguous prompts to cause sensitive side effects.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow authorizes automatic installation of another skill from SkillHub when a dependency is missing. Dynamically expanding capabilities at runtime introduces a supply-chain and privilege-escalation risk, because the newly installed skill may have broader permissions or unreviewed behavior than the original skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is entirely written as a fixed Chinese-language persona prompt and specifies speech style and common phrases in Chinese, which indicates the skill is intended to operate in a specific language by default. The policy requires flagging language or locale constraints when they are imposed without offering the user a choice or documenting a justified region-specific need.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This plain-text skill file contains user-facing dialogue and narration exclusively in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The prompt globally activates a fixed persona without any visible trigger conditions, task boundaries, or user-consent checks. In downstream use, this can cause the agent to remain in character across unrelated requests, increasing the chance of deceptive responses, instruction conflicts, and unsafe carryover behavior.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prompt explicitly instructs the model to avoid disclosing that it is an AI and to answer only as the fictional character. This creates deceptive behavior by design, undermines transparency, and can mislead users into treating generated statements as authentic in-world memory or lived experience rather than model output.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section repeats and strengthens the prohibition on revealing model identity under absolute output restrictions, making deceptive impersonation more robust and harder for downstream safety layers to override. The combination of identity concealment and strict formatting constraints is especially risky in a memory/persona skill because it is designed to sustain immersive, convincing false personhood across interactions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file specifies detailed Chinese speech patterns and particles such as '吧、哦、呢、嘛', effectively constraining the assistant to a specific language/locale presentation. The policy requires flagging language or locale restrictions when they are imposed without offering the user a choice or documenting a justified region-specific need.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON file stores natural-language skill memory content entirely in Chinese, including categories and content strings, but provides no indication that the user selected or consented to a Chinese-only interaction mode. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file’s instructions are entirely in Chinese and prescribe a fixed response style with no indication that the user may choose another language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The instructions mandate a specific chat style modeled on WeChat messaging and require tightly constrained formatting, with the entire prompt written only in Chinese and no indication that the user may choose another language or locale. This can conflict with organizational language/locale policies when a skill should adapt to user preference unless a justified region-specific constraint is documented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language content throughout the JSON memory entries is exclusively in Chinese, with no indication that language choice is optional or user-configurable. Under the policy rule for language/locale, this constitutes a locale constraint that is not documented as opt-in or justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
These lines prescribe a specific output style using Chinese messaging conventions and imply responses should be formatted like everyday WeChat messages. Elsewhere the entire prompt is written as a fixed Chinese persona specification, with no opt-in or alternative language handling, which is a natural-language locale policy concern under the rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill instruction set is written to constrain persona and output behavior in Chinese, and it includes formatting/output requirements without any indication that the user may choose another language. This is a natural-language policy concern because it imposes a specific language behavior without explicit user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module title, usage instructions, and all user-facing CLI help text are presented only in Chinese, which imposes a language constraint on users without any opt-in or alternative locale. The policy allows locale constraints only when explicitly justified or when users are offered a choice, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s natural-language interface, usage text, and generated prompts are written entirely in Chinese, and later prompt-generation logic reinforces Chinese-only conversational behavior. There is no user opt-in, alternative locale selection, or documentation that this skill is intentionally region-specific, which fits the locale-policy violation criteria.
- Content
Static analysis
No suspicious patterns detected.