T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:112- Finding
Shell Command Injection Through Unsanitized Filenames and Book Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Book Id
Security checks for vulnerabilities and agentic risk
Overview
This book cataloging skill is coherent overall, but needs review because it tells the agent to run shell commands on user-derived files and paths.
Review this skill before installing. It appears intended to catalog books, not to steal data or damage files, but you should only use it where shell commands are acceptable, fix-md.sh is trusted, and generated filenames or inbound media names cannot inject shell syntax. Confirm any vault push destination before approving export.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to execute a shell script after writing the file, even though shell execution is not inherently necessary to identify and catalog a book. Invoking arbitrary local scripts increases the attack surface substantially because the script may perform unexpected filesystem, network, or command actions beyond markdown formatting.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases are broad enough to match ordinary language such as 'log book' or 'add to library,' which can cause the skill to activate unexpectedly. Because the skill performs multi-step actions including file operations and web access, accidental invocation makes the overbroad triggering more dangerous in context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow includes web searches, duplicate checks, file creation, photo copying, and later external vault push behavior without a clear up-front user warning before these actions occur. Even if some actions are functionally related to cataloging, performing them without prominent consent can surprise users and lead to unintended data modification or disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill’s stated purpose is cataloging books, but it also specifies pushing resulting data into an external vault location. That expands the trust boundary from local note creation to external data transfer, which can expose user data or workspace contents beyond what a user reasonably expects from a cataloging skill.
- Content
Static analysis
No suspicious patterns detected.