T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:130- Finding
Unsafe Plaintext Storage of Child Identity and Payment Information
- Content
View full analysis
- Remediation
View remediation
Security audit
Kid Activity Registration Command Center
Security checks for vulnerabilities and agentic risk
Overview
The skill is a prompt-only family registration organizer, but it includes examples that tell users to store a child’s ID number and payment information in notes for copy/paste.
Review before installing. This skill has no code or network access, but users should not follow the examples that place a child's government ID number, payment details, or other sensitive information into notes or clipboard templates. Sensitive values should be entered only into official registration systems when required.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README presents the skill title/details and all assistant example responses in Chinese, while the user examples include English as well. This implies a fixed language behavior without user opt-in or an explicit language/locale choice, which matches the policy category for language or locale violations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases include broad requests such as "I need to register my child for activities" and "Organize sports signups," which overlap with ordinary conversation and are not narrowly scoped to this specific skill. The file does not provide negative examples or exclusion conditions to clarify when the skill should not activate.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Scenario 4 explicitly advises preparing and storing a child's ID number for rapid copy/paste, which conflicts with the skill's own boundary against requesting full sensitive IDs. Even if framed as registration efficiency, encouraging pre-staging sensitive child identity data increases the chance of over-collection, accidental disclosure, and insecure handling by users or downstream systems.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example recommends storing sensitive personal data, including a child's ID number, in a notes template for quick submission. This normalizes insecure handling of sensitive child data outside official systems and can lead to leakage through device compromise, sync services, clipboard history, screenshots, or accidental reuse in the assistant context.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 1. The response produces a registration command sheet, not general parenting advice. 2. Deadlines, waitlist risk, payment status, and receipts are tracked. 3. Required forms, waivers, gear, and first-day prep are organized without asking for sensitive ID values. 4. Schedule conflicts, commute burden, family capacity, and child interest are considered. 5. Calendar handoff and pickup/drop-off notes are included. 6. The response tells the user to verify official policies, fees, supervision, and medical requirements with organizers.
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest declares
language: en, but the document later includes a full Chinese usage scenario and output example. This creates an unclear language policy and may imply mixed-language behavior without explicit user choice or documented multilingual support.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest explicitly sets the skill language to "en". Under the policy provided, a fixed language/locale can be a natural-language policy violation when the skill does not offer a language choice or document a justified locale constraint.
- Content