Veadk Go Skills

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:51 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only code-generation skill for VeADK-Go agents, with no hidden execution or persistence, but users should review generated code for logging and file-output behavior.

Install only if you want Chinese-language VeADK-Go agent-generation guidance. Before running generated code, review any files it proposes to create or overwrite, replace placeholder API keys with secure environment handling, and remove or redact callback logging of full tool arguments and results.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: common/callback.md:160

Finding

Sensitive Tool Arguments Logged Without Redaction

Content

View full analysis

Vulnerability Details

File Location: common/callback.md:160-163
Vulnerability Type: Sensitive data exposure through application logs
Risk Level: Medium

Vulnerable Code

go

func onBeforeTool(ctx tool.Context, t tool.Tool, args map[string]any) (map[string]any, error) {
    log.Printf("[Callback] BeforeTool triggered for tool %q in agent %q.", t.Name(), ctx.AgentName())
    log.Printf("[Callback] Original args: %v", args)

Technical Analysis

The example callback serializes the complete tool argument map into application logs without field filtering, redaction, or sensitivity classification. Tool arguments may contain API keys, authorization tokens, passwords, personal information, private prompts, or confidential business data.

Because this Skill supplies templates intended for generated VeADK-Go applications, developers may copy this pattern into deployed agents. Logs commonly have broader access, longer retention periods, and more downstream integrations than the source request. Consequently, a secret that is appropriately protected while in transit may be exposed to log files, monitoring platforms, support personnel, or compromised logging accounts.

Attack Path

1. An application is generated using the documented BeforeToolCallback pattern.
2. A user, model, or integrated workflow invokes a tool with confidential values in its arguments.
3. The callback executes before the tool and formats the entire args map using %v.
4. The logging subsystem writes those values to local or centralized logs.
5. An actor with log-reading access retrieves and reuses exposed credentials or confidential data.

Exploitation requires the generated application to retain this example logging behavior and the attacker to obtain access to its logs or downstream telemetry.

Impact Assessment

This issue does not directly grant new operating-system privileges. Its scope depends on the values passed to tools and access represented by expo ...[truncated 285 chars]

Remediation

View remediation

Remediation Suggestions

• Remove full argument logging from the default example.
• Log only non-sensitive operational metadata, such as tool name, request identifier, duration, and success or failure status.
• If diagnostic payload logging is required, use an explicit allowlist of fields rather than a denylist.
• Recursively redact common sensitive keys, including authorization, api_key, token, secret, password, cookie, and credential.
• Ensure redaction covers nested maps, arrays, headers, and structured objects.
• Disable payload-level logging in production and apply least-privilege access controls, short retention periods, and encryption to log storage.
• Add automated tests that verify representative secrets cannot appear in emitted log records.

T09 · Insecure Skill Coding Practices

Warning

• Location: common/callback.md:191

Finding

Sensitive Tool Results Logged Without Redaction

Content

View full analysis

Vulnerability Details

File Location: common/callback.md:191-194
Vulnerability Type: Sensitive data exposure through application logs
Risk Level: Medium

Vulnerable Code

go

func onAfterTool(ctx tool.Context, t tool.Tool, args map[string]any, result map[string]any, err error) (map[string]any, error) {
    log.Printf("[Callback] AfterTool triggered for tool %q in agent %q.", t.Name(), ctx.AgentName())
    log.Printf("[Callback] Original result: %v", result)

Technical Analysis

The example after-tool callback writes the complete tool result map to logs without redaction. Tool results can contain retrieved documents, user records, authentication material, internal service responses, proprietary content, or other confidential data.

This occurs before any result-specific filtering demonstrated later in the callback. Therefore, subsequent transformation of the result cannot prevent the original content from already being disclosed. Applications generated from this template may also send logs to centralized observability systems, increasing the number of principals and systems able to access the data.

Attack Path

1. A generated application adopts the documented AfterToolCallback.
2. A tool retrieves or produces sensitive information.
3. Immediately after tool execution, the callback formats the complete result map using %v.
4. The unfiltered result is stored in local logs or forwarded to centralized telemetry.
5. An actor with access to those records extracts confidential content or reusable credentials.

Exploitation depends on sensitive data being returned by a tool and the attacker having access to application logs or an associated monitoring system.

Impact Assessment

The vulnerability primarily compromises confidentiality and does not independently elevate local privileges. Impact can include disclosure of private records, retrieved knowledge-base material, internal system data, or secrets returned by tools. If a ...[truncated 173 chars]

Remediation

View remediation

Remediation Suggestions

• Do not log complete tool results in the default callback template.
• Restrict routine logs to metadata such as tool name, result status, response size, latency, and correlation identifiers.
• Define per-tool output allowlists so only explicitly approved, non-sensitive fields can be logged.
• Apply recursive redaction before logging any structured result and omit response bodies for tools that process credentials, personal data, or confidential documents.
• Use production logging controls that enforce least-privilege access, encryption, retention limits, and audit trails.
• Add secret-detection and sensitive-data scanning to CI tests and observability pipelines.
• Document that post-processing a result after logging does not protect the original logged value.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger conditions are very broad and match common coding-assistance requests, which can cause the skill to activate in situations beyond the user's clear intent. That increases the chance of over-scoped code generation, unintended use of repository references, or application of conversion logic in contexts where a safer, narrower workflow should have been used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to save generated code artifacts to files without requiring a user-facing warning, confirmation, or clear boundary on file modifications. In an agent environment with write capabilities, this can lead to unexpected file creation or overwriting, which is especially risky because the skill's purpose is code generation and artifact output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is written as prescriptive guidance in Chinese throughout, including imperative instructions such as how to define agents and what naming must be used. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file title and substantial instructional content are written in Chinese, with no indication that users may choose another language or that the locale is required for a region-specific purpose. Under the policy, imposing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file contains natural-language guidance in Chinese and explicitly states that the docstring must be clearly defined, but the document as a whole presents the skill guidance only in Chinese with no opt-in or alternative locale. Under the policy rule for language/locale, forcing a specific language without user choice can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s instructional content is presented entirely in Chinese and directly addresses the reader in that language, with no indication that users may choose another language or that the skill is limited to a China-specific or Chinese-only context. This is a natural-language locale policy concern because it imposes a language choice without opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Lines L184-L185 describe AfterToolCallback as being invoked only when a tool execution successfully completes. However, the earlier definition at L034-L035 explicitly says the callback runs regardless of whether the tool returned a result or an error, so the documentation contradicts the actual documented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.