T09 · Insecure Skill Coding Practices
Error
- Location
scripts/employee-manager.js:53- Finding
Path Traversal Through Attacker-Controlled Employee Role
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Employee Team
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it needs Review because its local file handling can escape its intended folders and copy local files.
Install only if you are comfortable with a rough local prototype that writes persistent employee and memory files. Treat employee role and template inputs as trusted-only until path validation is fixed, and avoid running it in a workspace where the Node process can read sensitive files or write outside the skill directory.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/employee-manager.js:81- Finding
Arbitrary Local File Read Through Template Path Traversal
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill documentation appears to overstate implemented capabilities while omitting materially relevant behavior such as local filesystem read/write and archiving. That creates a trust and transparency problem: users may grant the skill broader access or rely on automation, monitoring, and reporting guarantees that do not actually exist, increasing the risk of unintended data handling or operational misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill documentation, command guidance, and examples are presented only in Chinese, with no indication that other languages are supported or that the user can opt into this locale. Under the stated policy, a skill that effectively requires a specific language without user choice is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document advertises persistent memory plus real-time monitoring/reporting without explaining what data is retained, for how long, where it is stored, or who can access it. In a collaboration/employee-tracking context, that can lead users to expose sensitive operational, personal, or proprietary information without informed consent or retention controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
User-facing comments, errors, logs, and CLI usage text are written in Chinese throughout the file, which effectively enforces a specific language for interaction. The file does not offer user opt-in, localization options, or documentation that this skill is intentionally limited to a Chinese-speaking context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code path allows a user to invoke a potentially irreversible management action directly from the command line. Although the function logs after completion, there is no confirmation prompt or pre-execution warning before changing employee records and moving that employee's memory directory.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language policy review applies to all file types. The user-facing content consistently forces a single language/locale experience, and there is no indication that the skill supports user language selection or that the Chinese-only constraint is intentional and justified for a region-specific use case.
- Content