T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:851- Finding
Persistent Storage of Potentially Identifiable Claim Data Without Defined Security Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Package Claim Helper
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent China courier-claim assistant, but it proposes persistent local storage of sensitive claim records without enough consent, deletion, retention, or storage-security detail.
Install only if you are comfortable sharing China courier dispute details with the agent. Before using it for real claims, confirm whether case storage can be disabled or cleared, avoid entering unnecessary personal details, and manually delete generated reports or local case records after use if the host provides no retention controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes the skill as a courier claim assistant for lost, damaged, or disputed packages with major China express companies. However, the skill documentation explicitly covers customs-hold scenarios, customs duty exemption analysis, and escalation to China Customs, which goes beyond courier-company claim assistance into customs/legal import matters.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Package lost in transit | Courier company | Courier is responsible for package safety unless force majeure | | Package damaged / contents broken | Courier company (high probability) | Packaging adequacy and insurance status affect compensation amount | | False delivery (shows signed but not received) | Courier company / courier | Courier signed without recipient's consent | | Station/locker dispute (unauthorized drop-off) | Courier company / courier | Dropping at station without consent violates regulations | | Return logistics anomaly | Sender's courier company | Return scenario: responsibility lies with the return carrier | | Wrong item sent by merchant | E-commerce merchant | Not a courier issue; product quality dispute | | Cross-border package held by customs | Customs / forwarding agent | Depends on duties / prohibited items / forwarding contract |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Package lost in transit | Courier company | Courier is responsible for package safety unless force majeure | | Package damaged / contents broken | Courier company (high probability) | Packaging adequacy and insurance status affect compensation amount | | False delivery (shows signed but not received) | Courier company / courier | Courier signed without recipient's consent | | Station/locker dispute (unauthorized drop-off) | Courier company / courier | Dropping at station without consent violates regulations | | Return logistics anomaly | Sender's courier company | Return scenario: responsibility lies with the return carrier | | Wrong item sent by merchant | E-commerce merchant | Not a courier issue; product quality dispute | | Cross-border package held by customs | Customs / forwarding agent | Depends on duties / prohibited items / forwarding contract |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents local persistence of anonymized case records and optional reports, but this retention is not surfaced near initial data collection where users are asked for tracking numbers, value proofs, communications, and other sensitive dispute details. Users may disclose personal or commercially sensitive information without meaningful notice, creating privacy and data-handling risk if the host environment is shared, compromised, or retains files longer than expected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest explicitly sets the skill language to "en", while the skill is built around China-specific companies, hotlines, and appeal platforms. This creates a natural-language policy concern because users are not given a language or locale choice, and no justification or opt-in mechanism is documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The description hard-codes a China-specific legal and operational context, which can create a locale-policy issue if users are not clearly opted into that regional scope before invocation. Although later sections make the scope clearer, the top-level description is broad enough that non-China users could invoke it without understanding the locale limitation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The refusal/disclaimer text says the assistant does not provide legal advice and should not replace a lawyer, yet multiple examples state categorical outcomes such as a company being 'fully liable,' an offer being 'incorrect,' or a practice being '违规.' That is a meaningful contradiction in intent framing because the documentation disclaims legal advice while modeling definitive legal adjudication.
- Content
Static analysis
No suspicious patterns detected.