T09 · Insecure Skill Coding Practices
Warning
- Location
src/index.js:278- Finding
CSV Formula Injection in Library Report Export
- Content
View full analysis
- Remediation
View remediation
Security audit
Second Brain Triage
Security checks for vulnerabilities and agentic risk
Overview
This is a local note-triage utility with no hidden network, credential, or persistence behavior, though CSV export should be used carefully with untrusted content.
Install only if you want a local text/notes triage helper. Prefer JSON or Markdown exports for untrusted notes, avoid opening generated CSV files from untrusted input in spreadsheet software unless the CSV escaping is fixed, and expect primarily Chinese-language output.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/triage.js:183- Finding
CSV Formula Injection in CLI Report Export
- Content
View full analysis
`. ### Attack Path 1. An attacker prepares content whose first nonempty line is a spreadsheet formula. 2. The victim passes that content directly to the CLI or processes an attacker-supplied text or batch JSON file. 3. The content analyzer promotes the first line to the exported title. 4. The victim requests CSV output, for example: ```bash node scripts/triage.js --batch items.js ...[truncated 1079 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description promises a PARA-based triage and categorization system for organizing notes and knowledge bases. However, this code does not implement PARA concepts or map content into Projects, Areas, Resources, or Archive. Instead, it performs generic content analysis: URL detection, content-type classification, task/code/email/article heuristics, and metadata extraction such as tags, dates, domain, and simple task priority parsing. While some extracted fields could support a larger organizer, this chunk's actual purpose is materially different from the declared PARA triage system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code chunk does not implement the declared PARA-based triage system. It never assigns items to Projects, Areas, Resources, or Archive, and it contains no scoring model for priority. Instead, its core purpose is detecting relationships among items via lexical/tag/semantic similarity, grouping related content, suggesting merges/links/tags, identifying topic clusters, and finding duplicates. While relatedness detection could support note organization as a secondary feature, the declared primary behavior and the implemented primary behavior are materially different.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description emphasizes PARA-based organization and automatic categorization of notes/content within a second-brain system. However, this code chunk does not implement PARA classification logic at all. Its core function is to score urgency using keyword matching, date parsing, contextual signals, and metadata, then generate recommendations and sort items by urgency. Priority scoring is mentioned in the description, but the stated primary framing is a PARA triage/categorization system; this code is a standalone urgency scorer with no Projects/Areas/Resources/Archive behavior. That is a material description-behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/triage.js "Text content to process"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/triage.js "Text content to process"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/triage.js "Text content to process"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The primary skill description is written in Chinese and the README provides no indication that other languages are supported or that the Chinese-only presentation is an intentional, region-specific constraint. This can violate a language/locale policy when users are not given an explicit language choice or opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says to use the skill whenever the user wants to organize notes, classify content, prioritize tasks, or manage a second brain, which is broad enough to trigger in many ordinary productivity conversations. Over-broad activation increases the chance the skill is invoked on unrelated or sensitive user content, creating unnecessary data exposure and potentially bypassing more appropriate, narrower skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Natural-language text in the banner, options, and examples forces a specific language for user interaction, which can violate language/locale policy when no opt-in or alternative is provided. The file does not indicate that this is a region-specific tool or give users a way to select another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file’s natural-language descriptions and comments are predominantly in Chinese, and the logic includes Chinese-specific content categories and patterns throughout the implementation. There is no visible indication that language handling is optional, user-selectable, or justified as a region-specific tool, which can conflict with a language/locale policy requiring user choice or documented constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file-level description and all user-facing strings are written in Chinese, including report headers, labels, and error text. There is no indication that users can choose another language or that the locale restriction is intentional and documented, which may violate a language/locale choice policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The class header and surrounding descriptive comments present the skill description in Chinese, and the classifier logic is heavily built around Chinese-language keywords and patterns alongside some English terms. There is no natural-language indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context, which can violate a language/locale policy requiring user choice or explicit justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code embeds user-facing descriptions and recommendation labels primarily in Chinese, including the module description and urgency labels, without indicating that language is configurable or chosen by the user. That creates a natural-language locale policy concern because the skill effectively enforces a specific language experience by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The returned recommendation and action-window strings are presented only in Chinese, and there is no visible option for callers or users to request another language. This is a policy-relevant locale constraint because the skill imposes a single language on end users without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file introduces a Chinese-language scenario and output expectations after predominantly English instructions, but does not explain how language is chosen or whether responses should match user language. This can create an implicit locale policy inconsistency rather than an explicit user opt-in or documented multilingual behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code performs a file write when
--outputis supplied, but the user-facing help only lists the option and does not disclose that the file will be written directly, potentially overwriting existing content. For SQP-2 on code files, file writes should have some visible disclosure such as a warning in help text, comment, or confirmation prompt unless clearly covered by the skill description.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file-level description and most comments are written in Chinese, while some identifiers and embedded terms are in English. Because the skill does not state that it is region-specific or provide any language/locale opt-in, this can be read as imposing a language choice on users or maintainers.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
Multiple test cases and string literals are written in Chinese, including titles, descriptions, and task text, but the file does not indicate that the skill is intentionally limited to Chinese input or that users can choose another language. Under the policy for natural-language violations, forcing or assuming a specific language without opt-in can be a locale-policy issue.
- Content
Static analysis
No suspicious patterns detected.