T09 · Insecure Skill Coding Practices
Error
- Location
scripts/folder-icon.js:125- Finding
Shell Command Injection Through CLI-Controlled Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
Folder Icon
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its folder-icon purpose, but unsafe command and temporary-script handling could let crafted local inputs run unintended commands.
Review before installing. Use only on test folders first, prefer --dry-run where available, avoid the Node script with untrusted path input, do not run from an elevated shell, and expect the skill to create icon files, desktop.ini files, Windows folder attributes, and outbound requests to icon sources.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/folder_icon_mdi.py:214- Finding
Predictable Shared VBScript Temporary File Enables Race Conditions and File Clobbering
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.en.md:33- Finding
Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/folder-icon.js:144- Finding
Mutable Remote SVG Assets Are Rendered Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This is a second confirmed mismatch report for the same location: the skill advertises two selectable schemes, including per-folder MDI folder.ico behavior, while the detected implementation only supports the centralized Tabler-style flow and uses undeclared network fetching. Such discrepancies undermine trust and can bypass user intent by causing execution paths or permissions that were not transparently disclosed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This is a second confirmed mismatch report for the same location: the skill advertises two selectable schemes, including per-folder MDI folder.ico behavior, while the detected implementation only supports the centralized Tabler-style flow and uses undeclared network fetching. Such discrepancies undermine trust and can bypass user intent by causing execution paths or permissions that were not transparently disclosed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents operations that affect the user's filesystem and folder behavior, including auto-configuring
desktop.iniand setting folder attributes, but it does not include any cautionary note about modifying folder metadata or potential side effects on Windows Explorer behavior. For markdown files, missing warnings about actions that can affect user data or system integrity should be flagged.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The primary README content is written in Chinese, which imposes a language choice on users without opt-in. Although the directory listing mentions an English skill document, this file itself does not offer language selection or explain that the skill is intended only for a Chinese-language audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README describes generating .ico files, writing desktop.ini, and changing folder attributes, but it does not present these actions as an explicit warning before execution. Users may run the skill without realizing it modifies filesystem metadata and persists configuration files across many folders, which can cause confusion, unwanted state changes, or difficult-to-reverse bulk edits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documents commands that forcibly terminate Explorer and delete Windows icon cache files without a clear safety warning or guidance to use them only as a last resort. While these are legitimate troubleshooting steps in this Windows-specific context, they are still destructive operational actions that can disrupt a user session, close shell state, and remove cache data if copied blindly.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill describes behavior that requires filesystem writes, shell commands, and network access, but it does not declare any tool scope or permission boundaries. In an agent environment, missing scope declarations can cause the skill to run with broader capabilities than users expect, increasing the chance of unauthorized file modification or command execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
这是一个 markdown 文件，需检查是否对可能影响用户数据或系统完整性的行为提供警告。L003 虽描述了会生成 .ico、写入 desktop.ini 和设置属性，但没有以警示形式提醒这些操作会批量修改目标目录及子文件夹、创建隐藏/系统文件并改变 Windows 文件夹属性。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill provides commands that forcibly kill Explorer and delete icon cache files without an accompanying warning about user disruption, possible loss of unsaved Explorer state, or the risks of running destructive shell commands. In an agent context, presenting these commands as routine recovery steps can lead to avoidable system impact if executed automatically or without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs users to forcibly terminate Explorer and delete the Windows icon cache, which are disruptive and partially destructive maintenance actions. While commonly used to refresh folder icons, these commands can interrupt the desktop session, close File Explorer state, and remove cached system data without clearly warning the user about side effects, prerequisites, or safer alternatives.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s user-facing documentation, usage text, and operational messages are written in Chinese only, and the script does not provide any option to select another language. This creates a natural-language policy issue because it imposes a specific language/locale on users without explicit opt-in or documented justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script invokes external commands such as npm, wslpath, curl, attrib.exe, and powershell.exe, which increases attack surface and makes behavior depend on the host PATH and platform utilities. In particular, shell-based command construction with user-influenced paths can lead to command injection or unexpected execution if quoting assumptions fail, and these commands exceed the minimal scope implied by simple icon manipulation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script downloads SVG content from GitHub at runtime and then feeds that untrusted remote data into the SVG rendering pipeline. This expands the trust boundary beyond the stated local file-manipulation behavior, creates supply-chain and integrity risk if the remote source changes or is intercepted, and can also leak usage metadata through unsolicited network access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module description, usage text, and argument help strings are all presented in Chinese, which imposes a locale/language constraint on users. There is no opt-in language selection or justification that this is intended only for a Chinese-language environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes two supported schemes: (A) centralized Tabler icons and (B) MDI icons copied into each subfolder as folder.ico. In this file, the implementation is hard-wired to a Tabler icon-name mapping, Tabler CDN/local SVG source handling, and desktop.ini references to generated icon files; there is no code path that creates or deploys MDI-based per-folder folder.ico assets.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code performs persistent file modifications by creating desktop.ini and marking it hidden/system, which affects folder behavior in Windows Explorer. Although the script logs progress while running, there is no prior disclosure in the file's usage text or CLI help that it will alter folder metadata and file attributes across subfolders.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def _set_attributes(path: Path, *attrs: str) -> None: """调用 attrib 命令。路径含空格时自动加引号。""" result = subprocess.run( ["attrib"] + list(attrs), str(path), capture_output=True, text=True )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def refresh_explorer() -> None: """通知 Windows 刷新 Explorer 以显示新图标。""" try: subprocess.run( ["powershell", "-Command", "Rundll32 user32.dll,UpdatePerUserSystemParameters"], capture_output=True
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation and argument help indicate that --icon-dir should override configuration, but load_config never applies cli_icon_dir and run() derives icon_output_dir only from cfg['icon_dir']. This is an active contradiction between user-facing intent and actual behavior, not just missing detail.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language strings that define usage and behavior, and they consistently require Chinese comprehension for safe operation. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill silently fetches SVG content from GitHub at runtime even though its stated purpose appears to be local folder-icon generation. This introduces a supply-chain and privacy risk: remote content could change, become unavailable, or be manipulated to produce unexpected results, and using the skill leaks icon selection/activity to an external service.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill's purpose is to generate and apply folder icons, which does require modifying filesystem metadata, but spawning cscript.exe through subprocess introduces command execution capability not declared in the manifest. This is a broader operational capability than simple file generation and configuration writing.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python with open(vbs_path, "w") as f: f.write(vbs) subprocess.run( ["/mnt/c/Windows/System32/cscript.exe", "/nologo", "D:\\_set_attrs.vbs"], capture_output=True, text=True, encoding="gbk", errors="replace" )
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The Tabler mode documentation lists requests as a dependency and references Tabler Icons CDN, but it does not clearly warn that remote icon data may be fetched over the network. This reduces transparency about external network access and supply-chain exposure, which matters in restricted or sensitive environments even if the fetched content is only icon material.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese, including the title, naming guidance, and procedural steps. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.
- Content