T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/checklist.py:55- Finding
Unvalidated Profile Data Enables Markdown Injection and Privacy Boundary Bypass
- Content
View full analysis
- Remediation
View remediation
Security audit
Moving Checklist
Security checks for vulnerabilities and agentic risk
Overview
This is a local moving-checklist generator with China-focused content and some output-sanitization/privacy caveats, but no hidden network, persistence, privilege, or destructive behavior.
Install only if a China-focused moving checklist is useful to you. Provide city/district-level locations and pseudonyms rather than full addresses or real household names, and treat generated Markdown as untrusted if profile text came from someone else.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The title presents the skill as a bilingual/Chinese-focused assistant, and the rest of the document uses Chinese-specific terminology, examples, and services. Because the skill does not explicitly offer a language or locale choice, this can amount to a natural-language locale policy violation under the stated rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file includes Chinese service names and multiple China-specific administrative assumptions, but does not indicate that the content is optional, region-specific, or selectable by the user. This can force a particular locale context on users outside that region rather than offering a neutral or configurable experience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This schema contains user-facing values in Chinese for fields like current, distance, and furniture, while household_size and city_tier use English-only values such as 'solo' and 'Tier 1'. Because the file provides no language-selection mechanism or justification for a fixed locale, it risks violating language/locale policy by implicitly forcing mixed locale handling on users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file includes natural-language content that defaults to Chinese-language inputs and China-specific administrative concepts such as 居委会, 社保, 居住证, and local moving services. Because the skill does not present this locale as optional or justified as region-specific, it effectively imposes a specific language/locale policy on users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The interactive setup requires users to respond using Chinese categories such as 整租/合租/自有 and 同城/跨城/跨国, and later output includes China-specific registration and address-change tasks. This is a natural-language policy concern because the skill constrains language and locale behavior without opt-in or a clearly documented regional scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The tags include "china" and the example invocation and first-success-path use Chinese phrases and Chinese-formatted address values, but the manifest does not state that the skill is China-specific or that Chinese is optional. This creates a natural-language locale policy issue because the skill appears to force a specific language/locale without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The reference data uses Chinese city names in the tier lists, which hard-codes a specific language/locale in this asset. Because there is no accompanying indication of user opt-in or explicit documentation that the skill is China-specific, this may violate the language/locale policy for natural-language content.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This JSON manifest-like file includes China-specific mover options and elsewhere references region-specific documents such as residence permits and social security, but the description at L02 only says it is for moving checklist categories. Without an explicit scope statement, the template's activation/use context is ambiguous and may be applied too broadly outside the intended locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description for
perioduses the exampleD-30~D-14, which reflects a locale-specific notation choice in natural-language metadata. Under the policy rule, locale-constraining language should either offer user choice or be clearly justified as region-specific, which this schema does not do.- Content
Static analysis
No suspicious patterns detected.