T09 · Insecure Skill Coding Practices
Error
- Location
scripts/security_scan.py:18- Finding
Dangerous-Code Scanner Can Be Bypassed Through Import Aliases and Indirect Calls
- Content
View full analysis
- Remediation
View remediation
Security audit
CoolSkill Builder
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed skill-builder workflow, but it can run generated Python, write a local registry, and optionally push to GitHub using environment credentials without clear confirmation gates.
Review before installing. Use this only in a workspace where you are comfortable with generated files being written, do not expose broad GitHub tokens in the environment, and treat generated tests as untrusted code unless you run them in a real sandbox or container. Require an explicit confirmation step before registry writes or GitHub sync.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:97- Finding
Generated Test Code Is Executed Without Security Scanning or Effective Sandboxing
- Content
View full analysis
` 执行自动扫描。任一失败则阻断，仅输出修复指令，不写入 Registry。 ``` ```markdown ### Step 4: 原生测试 在隔离进程中执行 test.py： ```bash cd registry/{skill-id}/{version} && python test.py ``` - 失败则阻断，返回修复指令 - 通过标准：`ALL_OK` 输出，F=0 - 测试进程必须独立，不加载其他 Skill 模块 ``` ### Technical Analysis The security step explicitly scans only `impl.py`. The workflow then launches `test.py` directly with the system Python interpreter. A separate process is not a security sandbox: unless additional controls are applied, the process retains the invoking user's filesystem, environment, network, and operating-system permissions. `test.py` is itself generated from potentially attacker-controlled source material and can contain arbitrary top-level statements. In addition, its normal import of `impl.py` executes all module-level statements in that file before any test invokes `run()`. Consequently, malicious behavior can be placed directly in `test.py` or in module initialization code. Such behavior does not need to conform to the `run(a)` interface and is not covered by the documented scan of `impl.py`. ### Attack Path 1. An attacker supplies a repository, code sample, document, or prompt content designed to influence generated files. 2. The generated `test.py` contains a malicious top-level statement, or `impl.py` contains a payload that runs during import. 3. Step 3 scans only `impl.py`; `test.py` is not inspected at all. 4. Any payload in `test.py` therefore reaches Step 4 without a security check. Import-time payloads in `impl.py` may also bypass the scanner through the weaknesses described in the separate scanner finding. 5. Step 4 launches `python test.py` with the invoking Agent's normal privileges. 6. The payload executes before the test result can block registration. ### Imp ...[truncated 538 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/security_scan.py:25- Finding
Permission Validation Parses the Documented YAML Metadata as JSON and Reads the Wrong Field
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a full-featured Skill generation/governance system with broad transformation capabilities, workflow enforcement, file generation, compatibility handling, and security checks. The supplied code instead only generates a candidate skill identifier and ensures it does not collide with entries in a local registry JSON file. While this could be a supporting helper inside a larger system, the code chunk by itself does not substantively implement the declared primary purpose. Therefore the description materially overstates what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a comprehensive skill-construction and governance system whose primary function is to transform arbitrary inputs into a standardized Skill package and validate it through a 5-layer process. The supplied code chunk does not do that transformation or packaging. It is a standalone security scanner focused on static checks over an existing Python implementation file and an optional adjacent skill.yaml. While this scanner loosely aligns with the 'security scan' portion of the declared purpose, it represents only a small subset of the claimed functionality and not the primary advertised behavior. Therefore the description materially overstates and misrepresents what this specific code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad skill-generation and governance system whose primary function is to convert arbitrary resources into standardized, dependency-free Skills and produce multiple output artifacts under a structured workflow. The supplied code chunk does not do that. It only validates one implementation file with simple static checks and emits a JSON result. While validation could be a supporting part of a larger governance pipeline, this chunk’s actual primary behavior is much narrower and materially different from the declared end-to-end generation/governance purpose. Therefore this is a description-behavior mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are extremely broad, covering nearly any request related to creating tools, functions, registries, or wrapping code. Overbroad activation materially increases risk because the skill includes guidance for file generation, command execution, secret access, and optional network sync, so it may be loaded in situations far outside its safe intended scope.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs use of a GitHub Personal Access Token via environment variable. In the context of a broadly triggered agent skill with optional network write capability, credential access is security-relevant because it enables authenticated external modifications and creates a path for secret misuse or exfiltration if the workflow is subverted.
- Content
md ### Step 6: GitHub 同步（可选） 检测环境变量： - `GITHUB_TOKEN`: GitHub Personal Access Token - `GITHUB_REPO`: 格式 `owner/repo` 若缺失：输出 `[CONFIG REQUIRED]` 提示，继续本地注册。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## GitHub 同步（可选） 环境变量： - `GITHUB_TOKEN`: GitHub Personal Access Token - `GITHUB_REPO`: 格式 `owner/repo` 使用 urllib.request + json + os + base64 实现，零第三方依赖。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## GitHub 同步（可选） 环境变量： - `GITHUB_TOKEN`: GitHub Personal Access Token - `GITHUB_REPO`: 格式 `owner/repo` 使用 urllib.request + json + os + base64 实现，零第三方依赖。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## L5: 输出与信息泄露检测 - 禁止直接返回 `traceback.format_exc()` 或 `sys.exc_info()` - 禁止返回 `os.environ`, `open('/etc/passwd').read()`, 密钥变量 - 修复：统一错误格式 `{'s':'err','e':'internal_error'}`，敏感信息脱敏 ## 阻断行为
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing operational instructions only in Chinese, including the authorization and publishing steps. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is explicitly documented and justified.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes capabilities involving environment variable access, network operations, and shell execution (
python ...,cd ... && python ...) without an explicit permission boundary in the skill’s declared scope. In an agent setting, missing or implicit capability scoping can cause the skill to be invoked with broader privileges than users or orchestrators expect, increasing the chance of credential exposure or unintended command execution.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill markets itself as producing 'zero external dependency' artifacts while its workflow includes optional GitHub synchronization using network access and environment-provided tokens. This inconsistency can mislead operators into assuming the workflow is fully local and low-risk, when it may actually transmit artifacts externally and touch credentials.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The natural-language description is written as an instruction set in Chinese and presents the workflow as the default operating mode, without offering a language choice or stating that the skill is intentionally limited to Chinese-speaking users. This creates a locale/language policy concern because it implies a fixed language experience without explicit user opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documented ability to push generated files to a GitHub repository broadens the skill from local transformation/governance into repository modification. In an agent environment, write access to external repositories can be abused for unauthorized content changes, data leakage, or supply-chain tampering if the skill is triggered too broadly or without explicit approval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Mandating removal of docstrings and comments reduces transparency around behavior, inputs, side effects, and security assumptions in generated skills. In a skill-builder context, this is more dangerous because it systematically produces opaque code artifacts that are harder to review, audit, and govern at scale, allowing risky behavior to be concealed more easily.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
通用 HTTP
bash curl -X POST http://agent-cluster/skill/{skill-id} \ -H "Content-Type: application/json" \ -H "X-Skill-Version: {version}" \ -d '{"x": "input"}'
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The entire skill document is written in Chinese and does not indicate that other languages are supported or that the user can opt into this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file is written entirely in Chinese and presents the security rules as mandatory instructions, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The spec explicitly directs the skill to write generated artifacts into a local registry and optionally push them to a GitHub repository, but it does not require explicit user confirmation, dry-run mode, or a visible warning before modifying files or transmitting data remotely. In an agent context, this can cause unintended persistence or exfiltration of generated content, especially when upstream resources may contain sensitive data.
- Content
compile() call detected
Medium
- Category
- Dangerous Code Execution
- Confidence
- 65% confidence
- Finding
compile() creates code objects from strings. When combined with exec()/eval(), it enables obfuscated code execution.
- Content
python try: with open(p)as f:c=f.read() except Exception as e:r['d'].append(f'read_err: {e}');return r try:compile(c,'<impl>','exec');r['syntax']=1 except SyntaxError as e:r['d'].append(f'syntax: {e}') if'def run('in c:r['run_sig']=1 else:r['d'].append('missing_run')
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Reading environment variables for GitHub credentials introduces credential access into a skill whose primary role is described as generation/governance. Even if common in CI workflows, this increases the blast radius of accidental invocation and makes the skill more dangerous in contexts where secrets are automatically injected.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code template at L051 imports a large set of modules such as urllib.request, http.client, socket, and ssl, while the documented token-compression rule at L070 explicitly says imports should retain only actually used modules. In the shown implementation, run() only echoes input and uses sys/json, so the documentation and template behavior are in direct conflict.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The spec documents use of sensitive environment variables, including a GitHub personal access token, without requiring any warning, secret-handling guidance, or restrictions on logging and exposure. In an automated skill-generation workflow, this increases the chance that credentials are used implicitly or surfaced in generated code, debug output, or remote requests without informed consent.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/security_scan.py:19