T09 · Insecure Skill Coding Practices
Note
- Location
src/reading_database/connection.py:9- Finding
Local SQLite Database Is Created Without Explicit Owner-Only Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Reading Manager
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent personal reading tracker with expected local storage and optional book-metadata lookups, though users should be aware of local data and external lookup behavior.
Install only if you want a local command-line reading tracker. Expect it to create a persistent SQLite database under ~/.config/reading-manager, modify or delete reading records when you run those commands, and send ISBN/search terms to Google Books for metadata lookups. Do not run test-publish.sh unless you intentionally want to publish the package, and avoid storing sensitive API keys in the database on shared machines.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill manages personal reading records and progress. The supplied code does not implement any reading-management functionality such as storing books, notes, or reports. Instead, it is a deployment script that navigates to a local workspace directory and invokes
clawhub publishto publish the skill externally. That is a materially different primary purpose and an undeclared capability, so this is a clear mismatch.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README content, headings, and usage guidance are entirely in Chinese, which imposes a specific language on users without indicating that alternatives are available. This matches the policy-violation category for language or locale constraints that are not optional or explicitly justified.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill documentation explicitly describes network-backed features such as fetching metadata from Google Books API / 豆瓣 API and online search, but it declares no tool scope or allowed-tools. Missing capability scoping weakens least-privilege controls and can allow broader network access than users or the platform expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented delete command removes books without any warning, confirmation, or mention of reversibility. In a personal data-management skill, this can lead to accidental loss of reading records, notes, and progress, especially if deletion cascades to related entries.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
reading list move 1 --to finished
创建自定义书单
reading list create "技术书单" --description "编程技术相关书籍" reading list add-book "技术书单" 1
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The import operation is documented without warning that it may overwrite, merge, or otherwise alter the user's existing reading database. Users may unintentionally corrupt or replace notes, progress history, or lists by importing incompatible or stale backups.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents destructive and data-moving operations such as delete, import, export, and external lookups, but it does not warn users that these actions can modify local state, overwrite data, or transmit book/article metadata and URLs to third-party services. In an agent setting, this omission can lead to unintended data loss or privacy exposure because the agent may invoke these commands without surfacing side effects clearly.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Move book between lists
reading list move 1 --to finished
Create a custom reading list
reading list create "Tech Books" --description "Programming and technology related books" reading list add-book "Tech Books" 1
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This manifest file includes a 'Use when:' activation description, but it is truncated after '(1) recording book', leaving the trigger scope unclear. Because the invocation guidance is incomplete, users or orchestrators cannot reliably tell when the skill should or should not be activated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring, function docstrings, and user-facing print messages are all written only in Chinese, which imposes a specific language choice without any opt-in or explanation. This can violate language/locale policy when the skill is not clearly documented as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file's docstrings, command help, prompts, and console messages are consistently presented in Chinese, with no indication that the user can choose another language or that the tool is intentionally limited to a Chinese-speaking audience. This creates a natural-language locale policy concern because the skill effectively enforces one language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Natural-language strings in the module, including the module docstring and function docstrings/comments, are written exclusively in Chinese with no indication that the user can select another language or that the skill is intentionally limited to a Chinese-only context. That can violate a language/locale policy when no opt-in or justification is provided.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The delete_book function permanently deletes a database record and commits the change, but the code provides no confirmation prompt, logging, or explanatory warning beyond a brief docstring. For a destructive operation affecting user data, the file lacks visible disclosure that deletion is occurring.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains natural-language strings exclusively in Chinese, including the module description and user-facing function docstrings. Under the policy, forcing a specific language without user opt-in or documented locale justification is a language/locale policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The delete_note function performs an irreversible DELETE operation on stored note data and commits it immediately. While there is a brief internal docstring, the file provides no confirmation prompt, logging, or clearer user-facing warning about this destructive action.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This codebase uses Chinese-only natural-language strings and labels, beginning with the module description "格式化工具". The file does not offer any user language selection or explain that the skill is intentionally limited to a Chinese-speaking context, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language description is written only in Chinese ("个人阅读管理系统 - 记录书籍、跟踪进度、管理笔记") with no indication that users can choose another language or that the package is intentionally region-specific. This can violate a language/locale policy when a skill or package implicitly forces a specific language without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code performs an external HTTP request using the user-provided query, which transmits user data to a third-party service. While the function names and docstrings indicate Google Books usage, there is no explicit warning, confirmation, or user-facing disclosure at the point where the query is sent.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This function transmits the provided ISBN to an external Google Books endpoint. The code lacks an explicit warning or confirmation that user-supplied lookup data will be shared with a third-party service.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes a personal reading management system for tracking books, articles, progress, notes, and reports, which primarily suggests local management functionality. This file imports and uses Google Books search functions to retrieve external metadata, adding network-backed lookup behavior not reflected in the provided description.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
When an ISBN is provided, the CLI automatically sends that identifier to an external service via
search_by_isbn_google(isbn). Although the code prints that it is searching, it does not clearly warn the user that data is being transmitted to a third-party network service.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This Python file contains user-facing natural-language descriptions only in Chinese, including the module description and function docstrings. Under the policy rule for language/locale constraints, forcing a specific language without offering a choice or documenting a justified locale-specific scope is a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module description and function docstrings are written entirely in Chinese, which imposes a specific language on users or maintainers without any opt-in or stated regional justification. This matches the language/locale policy concern for natural-language content in code files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains user-facing natural-language text in Chinese, starting with the module description and continuing in comments/config descriptions, with no indication that the skill is region-specific or that users can choose another language. Under the policy rule, forcing a specific language without opt-in is a locale-policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This file contains natural-language text that assumes a specific language locale ('工具模块') with no indication that the skill supports language choice or is intentionally region-specific. Under the policy, language-specific natural-language content can be a locale-policy concern when it is presented without user opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.