T09 · Insecure Skill Coding Practices
Warning
- Location
router.py:140- Finding
Plaintext Retention of Potentially Sensitive User Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
技能路由枢纽
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a local skill router, but it persistently logs user request text and lets local routing history influence future skill choices without enough safeguards.
Install only if you are comfortable with this router keeping local plaintext snippets of routed requests and using that history to influence future recommendations. Avoid routing secrets, credentials, private code, or sensitive personal data through it unless logging is removed or constrained, and validate any downstream system that automatically activates returned skill IDs.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
router.py:117- Finding
Unvalidated Persistent Routing State Can Inject Arbitrary Skill Identifiers
- Content
View full analysis
= max_n: break return result ``` ### Technical Analysis The router treats successful entries from persistent `routing_log.jsonl` state as trusted input. The `skill_id` value is inserted into the ranked result without verifying that it belongs to the selected scene's configured `skills` allowlist or that it refers to a legitimate installed Skill. Consequently, a malicious or compromised local component able to alter the routing log can create records with an arbitrary `skill_id` and an `outcome` of `success`. Repeated poisoned records increase that identifier's rank and cause it to take precedence over default choices. There is also an internal schema inconsistency. `log_routing()` writes a `selected_skills` list, while `get_top_skills()` reads a singular `skill_id` field. Normal records therefore do not produce the documented learning behavior, but crafted or externally introduced `skill_id` fields do influence future output. This asymmetry makes the state-poisoning path especially relevant. Th ...[truncated 1792 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Most of the declared description matches the code's primary purpose: it is indeed a routing hub that buckets by scene and limits selection to Top 3 relevant skills. It also stores routing history. However, a key advertised feature—'失败的技能自动降权' (failed skills automatically down-weighted)—is not implemented. The selection logic only looks for entries where outcome == 'success', but log_routing stores selected_skills as a list rather than per-skill records, and mark_outcome does not actually update any entry or apply penalties. As a result, the code does not perform the claimed failure-learning behavior, which is a material mismatch in declared functionality.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python }, "AI自我进化": { "keywords": ["进化", "自我", "意识", "自我意识", "成长", "学习", "记忆", "idle", "L3", "L4", "元认知", "置信度", "trajectory", "自我建模", "自我模型"], "skills": ["self-model", "self-evolve", "ai-consciousness-core", "ai-self-awareness-tracker", "idle-learning", "memory-dream", "memory-system-v2", "skill-self-improver", "memory-hygiene", "self-awareness-tracker", "self-model-L4"], "top_default": ["self-model", "idle-learning", "ai-consciousness-core"], }, "内容创作": {
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The docstring says this function 'marks' the result of a routing event, implying it will update stored outcomes for later learning. In reality, it parses each line and writes the entries back unchanged, so the implementation directly contradicts the documented intent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises executable usage that reads and writes local files (
routing_log.jsonl,skill_buckets.json) but does not declare any tool scope or permission boundaries. In a skill-routing component, undeclared file access weakens reviewability and can lead to unintended persistence or broader filesystem interaction than users or operators expect.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes storing raw routing history and success/failure outcomes without warning that user requests may be persisted. Because prompts can contain sensitive research, code, credentials, or personal data, silent logging creates a privacy and data-retention risk that can expose users if logs are accessed, reused, or mishandled.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, comments describing behavior, CLI usage text, and printed output are all fixed in Chinese. This imposes a specific language/locale on users without any opt-in or documented locale restriction, which matches the language-policy violation criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest and module docstring claim that failed skills are 'automatically down-weighted', but the actual selection logic in get_top_skills only counts successful outcomes and ignores failures entirely. This means the skill does not perform the stated failure-based learning behavior, creating a clear mismatch between declared functionality and code behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The router persists user queries to a plaintext JSONL log without notice, consent, minimization, or access controls. User task descriptions can contain secrets, personal data, research content, or credentials, so persistent logging creates a confidentiality and privacy exposure if the host, backups, or other local skills/users can read the file.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code stores slices of natural-language user task descriptions in persistent plaintext logs and later exposes them through reporting paths. In this skill context, routing prompts may include sensitive operational instructions, private business data, medical/research content, or credentials pasted by users, making retention and later disclosure materially risky.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language instructions and examples are presented entirely in Chinese, which can impose a language constraint on users without opt-in. The policy requires either offering a language/locale choice or clearly documenting why the locale restriction is necessary.
- Content