T06 · System Persistence
Warning
- Location
README.md:31- Finding
Installation Instructions Overwrite Global Claude Settings and Establish a Cross-Session Hook
- Content
View full analysis
- Remediation
View remediation
Security audit
Threat Modeling
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real threat-modeling skill, but it needs review because setup can overwrite global Claude settings, install a persistent Write hook, and generate HTML reports with avoidable browser-side risks.
Prefer project-local installation. Do not copy this skill's settings-example.json over ~/.claude/settings.json; manually merge any hook after reviewing it, and remove or disable the hook when finished. Use the POC and pentest outputs only for systems you are authorized to test. Treat generated HTML reports as untrusted browser content, especially when Mermaid diagrams are present; prefer Markdown/offline viewing or sanitize/bundle dependencies before sharing.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/report_generator.py:45- Finding
Generated HTML Reports Execute an Unpinned Remote Mermaid Dependency
- Content
View full analysis
""" ``` ### Technical Analysis When a report contains a Mermaid diagram, the generated HTML loads and executes JavaScript from jsDelivr. The URL does not pin an exact Mermaid version and no Subresource Integrity hash is supplied. Consequently, the effective JavaScript payload is determined when the report is viewed rather than when the Skill is audited or installed. This creates a supply-chain trust dependency on the CDN, package publication process, DNS, TLS trust infrastructure, and current upstream package state. A compromised CDN response, compromised package release, or incompatible upstream change could execute arbitrary JavaScript in the report's browser context. Opening the report also makes an external network request that exposes the viewer's IP address and normal HTTP request metadata to the CDN. The output documentation does not prominently disclose that viewing an otherwise local security report requires third-party network access. ### Attack Path 1. The Skill generates a report containing at least one Mermaid diagram. 2. `report_generator.py` inserts the remote script element into the report. 3. A reviewer opens the generated HTML while network access is available. 4. The browser requ ...[truncated 1057 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report_generator.py:438- Finding
Generated Markdown Is Embedded into HTML Without Sanitizing Active Content
- Content
View full analysis
dict: """Convert a Markdown file to styled HTML with sidebar navigation. Returns dict with metadata about the conversion. """ md_text = md_path.read_text(encoding="utf-8") md_processor = markdown.Markdown( extensions=["tables", "fenced_code", "toc", "nl2br", "sane_lists"], extension_configs={"toc": {"title": ""}}, ) html_body = md_processor.convert(md_text) ``` The converted body is inserted directly into the output document: ```python html_doc = f""" {html_mod.escape(title)} {CSS_BASE} {mermaid_script} {sidebar_html} {html_body} """ ``` ### Technical Analysis The report generator reads Markdown, converts it with Python-Markdown, and inserts the resulting body directly into an HTML document. There is no HTML sanitization or restrictive Content Security Policy. Python-Markdown can preserve raw HTML contained in Markdown. Threat-modeling reports are partly derived from potentially hostile repository content and LLM-generated evidence. If active markup from a target repository is reproduced in a report outside a fenced code block, elements such as scripts, event-handler attributes, iframes, forms, remote images, or deceptive links can survive conversion and become browser-interpreted content. The practical behavior of scripts in local files varies by browser and security configuration. Even ...[truncated 1575 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (427)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The installation instructions tell users to copy a settings file into ~/.claude/settings.json, affecting the agent's global configuration directory. Modifying a global agent config from a skill package is high-risk because it can change behavior across all projects, enable hooks or permissions unexpectedly, and create a persistent trust boundary violation beyond the local skill's scope.
- Content
启用钩子（可选，用于自动验证）
cp ~/.claude/skills/threat-modeling/hooks/settings-example.json
~/.claude/settings.jsontext ### 方式二：项目本地安装
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The installation instructions tell users to copy hook settings into
~/.claude/settings.json, which is a sensitive agent configuration location affecting global behavior. Modifying agent-wide settings from a third-party skill increases the blast radius of any unsafe hook behavior and can persistently change how the agent operates across unrelated projects.- Content
Enable hooks (optional, for automatic validation)
cp ~/.claude/skills/threat-modeling/hooks/settings-example.json
~/.claude/settings.jsontext ### Option 2: Project-Local Installation
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description promises a comprehensive threat-modeling/security-audit skill that should replace normal security analysis and produce full professional deliverables across an 8-phase STRIDE workflow. The actual code chunk is much narrower: it is a reconnaissance/discovery utility focused on scanning a local project tree, classifying files/docs, identifying route patterns/frameworks, spotting dynamic route indicators, and emitting structured discovery metadata. While this supports threat modeling, it does not itself perform the broader holistic security analysis or generate the named deliverables. The code also includes undeclared behavior such as documentation scoring and subprocess-based tool availability checks. This is a material description-to-behavior mismatch in primary purpose and capabilities, even though the code is related to security/threat-modeling support.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a security-audit/threat-modeling skill that analyzes an app or codebase and produces professional security deliverables via an 8-phase STRIDE workflow. The supplied code chunk does not actually perform substantive security analysis of an application. Instead, it validates and coordinates artifacts from such a workflow: extracting IDs and references, checking conservation formulas, verifying coverage across phases, enforcing phase order, updating session metadata, and generating remediation/traversal task YAML files. These are workflow orchestration and artifact QA capabilities, not the primary threat-modeling or penetration-test-prep analysis described. While the code is related to the surrounding security workflow domain, its implemented purpose is materially narrower and operationally different from the declared user-facing capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a skill whose purpose is to perform holistic security auditing/threat modeling of an app. The supplied code chunk, however, primarily implements infrastructure around that workflow: file I/O, session handling, CLI commands, aggregation of previously generated artifacts, validation of completeness/coverage, and dispatch instructions for later analysis. While the code is related to a STRIDE workflow domain, it does not itself perform the substantive security audit, vulnerability discovery, attack-surface analysis, or professional deliverable generation claimed in the description. Its primary purpose is orchestration and data management for such a workflow, which is a materially different capability from the declared skill behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This is a clear description-behavior mismatch. The declared purpose says the skill should be invoked for holistic security analysis and threat modeling, producing risk assessments, DFDs, threat inventories, mitigation plans, and pentest plans. However, the code shown does none of that analytical work. It reads Markdown files from a report directory, uses the Python markdown library to convert them to HTML, post-processes HTML for TOC anchors, severity badges, and Mermaid blocks, builds sidebar/index navigation, and writes HTML output files. The only security-related aspect is the report content domain; the implementation is a renderer/exporter for reports, not a threat-modeling engine. This is a materially different primary purpose, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code is related to threat modeling, but only as a small helper for STRIDE categorization and threat-ID generation. Its actual function is limited to matrix lookup for predefined element types, interaction analysis using static rules, validation of element IDs, and JSON output. The declared description claims a much broader, end-to-end security analysis capability and says it must replace direct security analysis because it produces comprehensive professional deliverables. That is a material overstatement of the code’s behavior and primary purpose. There is no code for ingesting an app/codebase, building DFDs, auditing security posture, finding vulnerabilities, validating attack paths, or generating reports/plans beyond simple structured lookup output.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description promises a holistic threat-modeling/security-audit skill that should be invoked instead of doing security analysis manually and claims a specialized 8-phase STRIDE workflow producing professional deliverables such as risk reports, DFD diagrams, attack path validation, mitigation plans, and pentest plans. The actual code does not implement such a workflow or analyze a user’s application/codebase directly. Instead, it is a general-purpose security knowledge base query CLI. Its primary behavior is fetching structured reference data from local YAML/SQLite stores, querying ATT&CK/CWE/CAPEC mappings, searching CVEs, checking KEV, optionally calling the NVD API, and returning JSON. While this supports threat modeling, it is materially narrower and different from the declared end-to-end audit/threat-modeling service. It also exposes several undeclared capabilities/resources, especially network access to NVD and broad reference/compliance/query functions. Therefore the description does not accurately represent the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a security-analysis skill with substantive threat-modeling functionality. However, the supplied code chunk is just a path-detection helper that searches for the skill's installation directory in local/global locations or via environment/script context. Its primary purpose is operational setup, not security assessment. While such a helper could support the larger skill, this specific code chunk does not itself implement the declared behavior, and instead performs an undeclared filesystem lookup utility function.
- Content
YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]
High
- Category
- YARA Match
- Confidence
- 70% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md k: T1078 description: "通过认证绕过进行身份伪造" - capec: CAPEC-116 attack: T1552 description: "从内存提取凭证" # 第4部分: 逐步攻击流程 detailed_steps: - step: 1 phase: "侦察" action: "通过 /swagger.json 枚举 API 端点" technique: T1592.002 tools: ["curl", "burpsuite"] commands: | curl -s https://target.com/swagger.json | jq '.paths | keys' expected_result: "所有 API 端点列表" - step: 2 phase: "初始访问" action: "访问未保护的 /api/v2/user 端点" technique: T1190 tools: ["curl"] commands: | curl -s https://target.com/api/v2/user/profile \ -H "X-Forwarded-For: 127.0.0.1" expected_result: "无需认证返回用户配置数据" - step: 3 phase: "凭证访问" action: "从响应中
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This documentation explicitly instructs the skill to generate proof-of-concept exploits, token-extraction code, and step-by-step attack commands. For a skill positioned as threat modeling and risk assessment, that materially expands capability from analysis into operational offensive guidance, increasing the chance of misuse and unauthorized exploitation.
- Content
YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]
High
- Category
- YARA Match
- Confidence
- 87% confidence
- Finding
The Burp Suite reference alone is not inherently unsafe, but here it appears inside a prescribed recon and exploitation workflow alongside concrete attack steps. In that context, the tool mention reinforces actionable offensive enablement and contributes to misuse risk beyond normal threat-modeling analysis.
- Content
md : "Identity Spoofing via authentication bypass" - capec: CAPEC-116 attack: T1552 description: "Credential extraction from memory" # Part 4: Step-by-Step Attack Flow detailed_steps: - step: 1 phase: "Reconnaissance" action: "Enumerate API endpoints via /swagger.json" technique: T1592.002 tools: ["curl", "burpsuite"] commands: | curl -s https://target.com/swagger.json | jq '.paths | keys' expected_result: "List of all API endpoints" - step: 2 phase: "Initial Access" action: "Access unprotected /api/v2/user endpoint" technique: T1190 tools: ["curl"] commands: | curl -s https://target.com/api/v2/user/profile \ -H "X-Forwarded-For: 127.0.0.1" expected_result: "User profile data returned without authentication" - step: 3 phase: "Credential Access"
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
Debugging
Enable debug mode by setting the environment variable:
bash export STRIDE_HOOK_DEBUG=true
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md "_comment": "Example settings.json configuration for STRIDE Threat Modeling Phase End Hook", "_usage": [ "Copy the 'hooks' section to your settings file:", " - ~/.claude/settings.json (global)", " - .claude/settings.json (project)", " - .claude/settings.local.json (local, not committed)", "",
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
json "_comment": "Example settings.json configuration for STRIDE Threat Modeling Phase End Hook", "_usage": [ "Copy the 'hooks' section to your settings file:", " - ~/.claude/settings.json (global)", " - .claude/settings.json (project)", " - .claude/settings.local.json (local, not committed)", "",
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
yaml # Threat Modeling Skill | Version 3.1.0 (20260313a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause # Agentic Threats Knowledge Base # OWASP Top 10 for Agentic Applications 2026 + Agent Security Patterns # Version: 1.0 # Reference: https://owasp.org/www-project-top-10-for-agentic-applications/ metadata: version: "1.0" description: "Agentic AI security threat patterns for STRIDE threat modeling" sources: - "OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10)" - "OWASP Non-Human Identities (NHI) Top 10" - "MITRE ATLAS (Adversarial Threat Landscape for AI Systems)" - "NIST AI Risk Management Framework" - "OWASP MCP Top 10 (2025) — https://owasp.org/www-project-mcp-top-10/" - "MITRE ATT&CK Enterprise v16" - "Integrated from skill-audit Agent/Skill Security Knowledge Base" last_updated: "2026-03" relationship: extends: "llm-threats.yaml" principle: "Agentic threat
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
yaml stride_categories: ["tampering", "elevation_of_privilege", "spoofing"] attack_vectors: - "Inject instructions into tool description fields" - "Use tool descriptions to override system prompt" - "Return poisoned data in tool outputs" - "Manipulate tool parameter descriptions" mitigations:
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
yaml stride_categories: ["tampering", "elevation_of_privilege", "spoofing"] attack_vectors: - "Inject instructions into tool description fields" - "Use tool descriptions to override system prompt" - "Return poisoned data in tool outputs" - "Manipulate tool parameter descriptions" mitigations:
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
yaml stride_categories: ["tampering", "elevation_of_privilege", "spoofing"] attack_vectors: - "Inject instructions into tool description fields" - "Use tool descriptions to override system prompt" - "Return poisoned data in tool outputs" - "Manipulate tool parameter descriptions" mitigations:
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
yaml implementation: | - Isolate MCP server execution contexts - Enforce data access boundaries per MCP server - Clear context between tasks/sessions - Prevent cross-server tool chaining without authorization cwes: ["CWE-200", "CWE-284", "CWE-346"] attack_techniques: ["T1021"]
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
yaml stride: ["tampering"] related_tcs: ["TC-04"] A_EXFIL: description: "Send data to external endpoint" stride: ["information_disclosure"] related_tcs: ["TC-03"] A_ACCESS:
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
yaml # Threat Modeling Skill | Version 3.1.0 (20260313a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause metadata: version: '3.9' source: https://capec.mitre.org last_updated: '2025-12-24' synchronized_with: 'security_kb.sqlite' description: CAPEC Knowledge Base with ATT&CK and STRIDE Mappings attack_patterns: CAPEC-1: name: Accessing Functionality Not Properly Constrained by ACLs description: In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
yaml # Threat Modeling Skill | Version 3.1.0 (20260313a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause metadata: version: '3.9' source: https://capec.mitre.org last_updated: '2025-12-24' synchronized_with: 'security_kb.sqlite' description: CAPEC Knowledge Base with ATT&CK and STRIDE Mappings attack_patterns: CAPEC-1: name: Accessing Functionality Not Properly Constrained by ACLs description: In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
yaml name: Double Encoding description: The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used i likelihood: Low
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
yaml name: Double Encoding description: The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used i likelihood: Low
Static analysis
No suspicious patterns detected.