T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:56- Finding
Automatic Persistent Storage Uses an Unsanitized User-Controlled Filename
- Content
View full analysis
- Remediation
View remediation
Security audit
日更100条方法论
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed short-video content planning guide, but it defaults to saving personal/business plans under a user-controlled filename without consent or path-safety limits.
Review before installing. Use it only in a workspace where saving business plans is acceptable, avoid confidential strategy or customer data unless you explicitly want it retained, and require confirmation before any file saving, scraping, sending, or publishing action. A safer version would disable persistence by default and sanitize or replace user names in filenames.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad, natural-language phrases such as '帮我做方案' and '帮我写口播' that can match ordinary user requests outside the narrow intended scope of this skill. That increases the chance of accidental activation and unintended instruction injection into unrelated conversations, especially because the skill is designed to shape persuasive content and growth strategies.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes broad, common requests such as '帮我做方案', '帮我起号', and '数据复盘', which are plausible in many unrelated conversations. This can cause unintended skill activation and steer the assistant into this skill's behavior without clear user intent, increasing the chance of irrelevant guidance or unrequested workflow changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that saying broad phrases like '帮我做方案/帮我起号/帮我写口播' should automatically activate the workflow. Because these are generic content-assistance requests, the skill may hijack normal conversations and begin collecting data or generating outputs the user did not specifically request from this skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill says configuration will be saved to 'references/用户方案_{姓名}.md' for future automatic loading, but it does not clearly warn the user that personal information will be stored persistently. This creates a privacy risk because names, business details, and potentially sensitive planning data may be written to disk without informed consent or any retention limits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The default behavior says generated plans will be directly output and saved to 'references/用户方案_{姓名}.md' even when the user has not explicitly requested storage. Default-on persistence without a privacy notice or retention policy can expose sensitive commercial and personal data and creates unnecessary long-term data handling risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The metadata advertises several generic trigger phrases such as '帮我做方案', '帮我起号', and '数据复盘' that are common everyday requests and are not tightly scoped to this skill’s intended methodology. Broad activations can cause the skill to trigger unexpectedly in unrelated conversations, increasing the chance of inappropriate content injection, workflow hijacking, or unreviewed operational guidance being applied out of context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation conditions are tied to common conversational phrases like '介绍一下你自己' and '你能做什么', which can be triggered during ordinary user interaction rather than clear, intentional skill invocation. That creates an unintended prompt-routing risk where the skill may activate out of context, override the expected assistant behavior, and steer users into its high-volume content-generation workflow without explicit consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script instructs the agent to respond in Chinese and does not provide a language choice or fallback based on the user's preferences. While not a direct code-execution issue, this can cause unsafe or misleading interaction flow by overriding user intent, reducing transparency, and making consent and task understanding weaker for users expecting another language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file defines broad, natural-language conditions for loading and chaining other skills across scraping, video generation, and distribution workflows. Because the trigger description is high-level and overlaps with common user requests, it can cause unintended invocation of powerful downstream capabilities, increasing the chance of unauthorized scraping, mass actions, or accidental publication.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section promotes competitor-data scraping, transcription, browser-driven sending, and cross-platform publishing, but does not include privacy, authorization, platform-terms, or human-review safeguards. In a content-operations skill, that omission is dangerous because it normalizes collection and dissemination workflows that may process third-party data or trigger external actions without validating consent, legality, or destination accuracy.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation guidance is broad enough that ordinary requests about speaking style or tailored scripts could load this file unexpectedly, expanding the skill’s influence beyond clearly scoped use cases. In this context, that is more concerning because the file contains manipulative and adversarial persuasion patterns such as controversy amplification, persona switching to deflect criticism, and instructions to avoid apology or override disputes, which could steer benign user requests into risky content-generation behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
All user-facing documentation and activation examples are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can constitute a locale/language policy issue when a skill implicitly forces a specific language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The entire skill file is written in Chinese and does not indicate whether users may request outputs in other languages or locales. Under the stated policy, a language constraint should either be optional for the user or explicitly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file contains natural-language instructions and analysis exclusively in Chinese, but it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy for language or locale constraints, forcing a specific language without opt-in can be a policy violation.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description says to load this file whenever the user needs to track release performance or optimize topic direction, but it does not define specific trigger phrases, scope limits, or exclusion conditions. This broad natural-language condition could overlap with many general analytics or planning requests and cause unintended invocation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. This markdown file presents all instructions and analysis in Chinese only, with no opt-in, alternative language, or justification that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
All natural-language guidance, templates, and examples are written as if the skill operates in Chinese only, with no opt-in or alternative locale handling described. Under the language/locale policy, forcing a specific language without user choice can be a policy concern unless the locale restriction is explicitly documented and justified.
- Content
Static analysis
No suspicious patterns detected.