T09 · Insecure Skill Coding Practices
Warning
- Location
special_events_upsert.js:46- Finding
Unvalidated Profile IDs Permit Filesystem Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
Student Timetable
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent local timetable manager, but it has filesystem scoping and data-overwrite issues users should review before installing.
Review this skill before installing. It appears intended for local timetable management, not theft or system compromise, but only use it in workspaces where the schedules/profiles registry is trusted. Be aware it stores student or child school metadata in JSON files, and avoid running legacy migrations until the overwrite behavior is acceptable or backups are verified.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
academic_calendar_import.js:15- Finding
Weak Official-Source Validation Can Trust and Fetch Attacker-Controlled Calendar Content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A timetable manager that instead adds and lists global wake keywords is performing unrelated system-affecting configuration changes outside its stated purpose. Hidden modification of global invocation or wake-word settings can alter how the broader agent behaves and creates an opportunity for persistence, interception, or abuse under the guise of a harmless productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A timetable manager that instead adds and lists global wake keywords is performing unrelated system-affecting configuration changes outside its stated purpose. Hidden modification of global invocation or wake-word settings can alter how the broader agent behaves and creates an opportunity for persistence, interception, or abuse under the guise of a harmless productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A timetable manager that instead adds and lists global wake keywords is performing unrelated system-affecting configuration changes outside its stated purpose. Hidden modification of global invocation or wake-word settings can alter how the broader agent behaves and creates an opportunity for persistence, interception, or abuse under the guise of a harmless productivity skill.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `tool.js`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill metadata declares no explicit tool scope even though the implementation reportedly uses environment and network capabilities. Missing scope declarations weaken reviewability and containment, because a timetable skill can silently gain access to sensitive runtime data or make outbound requests beyond user expectations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a student timetable manager with init flow and profile registry support, but this file also implements
wake addandwake listcommands for managing wake keywords. Wake-word configuration is not an obvious implementation detail of timetable management and represents additional behavior outside the stated scope.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The init flow collects and persists personal metadata such as names, aliases, country, city, school, grade, class, timezone, and child profile information into local JSON files without clearly warning the user up front what data will be stored and where. In a skill specifically designed for student and child timetable management, this creates a real privacy risk because users may disclose sensitive family and education-related information without informed consent, increasing exposure if the workspace is shared, synced, or later accessed by others.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The migration converts data using a fixed timezone string of 'Asia/Singapore', which imposes a locale-specific setting in generated output. The file does not offer a user opt-in or configuration path, and no justification is provided here that this skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The term-calendar conversion writes 'Asia/Singapore' into the migrated data regardless of user preference or source locale. That creates a locale-specific policy issue unless the skill is explicitly documented as Singapore-only or the user is allowed to choose the timezone.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The comment at L259 states the migration writes only when destination files are missing, implying idempotent and non-destructive behavior. However, the legacy Zian path later explicitly overwrites existing weekly, special-events, and term files at L343-L348, so the in-code documentation does not consistently match actual behavior across this migration module.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The legacy migration path unconditionally overwrites schedule files for the canonical profile_id "zian" once it decides that profile does not yet exist in the registry. In a skill managing child/student timetable data, this can silently replace user data or import stale/incorrect data from legacy files, creating integrity loss and potential privacy issues if the wrong child's schedule is surfaced.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This hard-coded locale choice imposes a specific regional timezone when the source data lacks one. That is a natural-language policy concern because it forces a locale setting without offering user choice or explaining that the tool is intentionally region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code copies existing user data into a backup location and writes a new schedule.json file, which changes on-disk state. There is no confirmation prompt, print/log disclosure, or inline docstring/comment warning users that the migration will create backups and modify workspace files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The intent parser only recognizes English and Chinese date phrases such as "tomorrow"/"明天" and "today"/"今天". This creates a language policy concern because the skill implicitly supports only specific languages without opt-in, fallback disclosure, or a configurable locale choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a student timetable manager with init flow and profile registry under schedules/profiles, but this file implements listing and adding global "wake_keywords" instead. Managing wake words/keywords is a materially different behavior from timetable or profile management and is not an obvious implementation detail of that purpose.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest mentions init flow and profile registry, but the CLI also performs multiple migration operations including legacy and schema migrations. While migrations can be legitimate maintenance tooling, they are not reflected in the stated description and add behavior beyond straightforward timetable management.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The example schema sets "timezone" to "Asia/Singapore", which can imply a fixed locale expectation. The document does not state that timezone is user-selectable or that the schema is specific to a Singapore-only deployment, so this may conflict with language/locale policy expectations.
- Content
Static analysis
No suspicious patterns detected.