T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/employee-manager.js:50- Finding
Directory Traversal Through Unsanitized Employee IDs and Template Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
AI员工协作技能包
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it overpromises automation and has unsafe local file handling that could read or write outside its intended folders.
Review this before installing. Use it only in an isolated project or container, do not store sensitive team or employee data in it, and do not pass untrusted role, employee ID, or template values. Expect the current package to behave mainly as a local employee record and memory manager, not as the full automation system described.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
描述强调的是“协作技能包”，核心能力应包括多角色协同、任务自动分配、进度跟踪和结果汇报。实际代码只覆盖了其中一部分：员工档案/角色配置、状态更新、简单团队概览和记忆文件管理。虽然有 currentTask/status 字段，但没有任务队列、调度逻辑、自动分配机制、执行编排、报告生成或多AI协作流程。因此代码的实际主功能明显更窄，属于员工信息与状态管理工具，而不是描述中的完整自动化协作系统。文件系统读写属于实现细节，本身不构成额外风险点；主要问题是声明的关键能力未被实现。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill description, commands, and guidance are presented only in Chinese, and there is no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises persistent memory and real-time status monitoring, which strongly implies storage and ongoing processing of potentially sensitive team, project, or user data, yet provides no disclosure, retention policy, access model, or security warning. In a collaboration/employee-management context, this can lead users to expose internal business data without understanding where it is stored, who can access it, or how long it is retained.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's natural-language interface is consistently Chinese in comments, errors, log messages, and usage text, and there is no indication that users can opt into another language. Per the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Natural-language policy checks apply to all file types. The file consistently presents the skill interface and documentation in a single language without offering an alternative language option or noting that the skill is intended only for Chinese-speaking users.
- Content