T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:3- Finding
Sensitive Credential Collection and Export Without Enforceable Protection
- Content
View full analysis
- Remediation
View remediation
Security audit
Touqi Todo
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it asks users to record passwords and deeply private end-of-life information without real safeguards.
Review carefully before installing. Do not enter raw passwords, recovery codes, private keys, API tokens, or MFA secrets into this skill; use a password manager or secure estate-planning process instead. Treat any visibility labels or PDF output as organizational notes, not real access control, unless the platform separately provides verified encryption, retention, deletion, and sharing controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description explicitly covers extremely sensitive data categories, including account passwords, private final messages, and digital-estate instructions, but provides no prominent user warning about the privacy and security implications. Users may disclose secrets they would not otherwise share if they are not told upfront that such information is sensitive and should be minimized or handled through safer alternatives.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is explicitly intended to gather and retain highly sensitive personal material, including passwords, posthumous instructions, and private messages, and it also references optional capture from other conversations. This creates a broad data-collection surface involving secrets and emotionally sensitive disclosures, making misuse, overcollection, or accidental exposure materially dangerous.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction to unconditionally record any user content first means the system will ingest sensitive disclosures before assessing necessity, scope, or risk. In a skill centered on final wishes, credentials, and family messages, that default-retention posture is dangerous because it encourages overcollection of secrets and deeply private content without upfront safeguards.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The optional background capture feature allows the system to extract related content from other chats into a candidate pool, but it is not paired with a strong warning explaining the privacy consequences of cross-conversation collection. Even with opt-in language, users may not understand that unrelated or intimate context could be inferred, retained, and later surfaced.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The '顺手记' feature instructs the agent to mine other user conversations for relevant content and place it into a candidate pool, which expands collection beyond the immediate request. In this skill's context, that is especially dangerous because it can silently aggregate passwords, private messages, family disclosures, or end-of-life statements from conversations where the user did not intend formal retention.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level description says the skill should be proactively used whenever users mention broad topics like death preparation, wills, account handoff, or messages to family, without clear scope boundaries. Because the skill handles passwords, private messages, and digital inheritance, broad proactive invocation increases the chance of collecting sensitive data before informed user intent is established.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include very broad everyday requests such as '帮我记一下 / 整理一下', which can cause the skill to activate outside the user's clear intent to handle end-of-life or digital-estate material. In this context, unintended activation is especially risky because the skill is designed to collect highly sensitive content, so over-triggering can lead to unnecessary intake and retention of private data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instructions specify user-visible wording in Chinese, including exact terms such as "隔离/遮蔽/剔除", but do not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking locale. This can violate language or locale policy when applied to users who have not opted into Chinese interactions.
- Content