T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_outfit.py:85- Finding
Unrestricted Retrieval and Processing of Server-Controlled URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
AI 衣橱搭配
Security checks for vulnerabilities and agentic risk
Overview
This outfit skill appears purpose-built rather than malicious, but it gives a remote API too much control over what the local machine downloads, processes, and opens.
Install only if you trust the aicloset API operator and are comfortable sending outfit context plus an API key to that service. Prefer running it in a constrained environment without access to sensitive local files or internal network services, and avoid using it on shared multi-user systems until URL validation, safer temporary-file handling, and opt-in preview behavior are added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_outfit.py:23- Finding
Predictable Temporary Directory Enables Symlink-Based File Clobbering
- Content
View full analysis
` for the expected timestamp and configures it so the victim process can write within it. 3. The attacker creates `item_tmp.png` inside that directory as a symbolic link to a file writable by the Skill user. 4. The Skill computes the same timestamp-based path. 5. `mkdir(parents=True, exist ...[truncated 1011 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (10)
Tainted flow: 'req' from os.environ.get (line 50, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python result = None for attempt in range(2): try: with request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode("utf-8")) break except Exception as e:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes external scripts and relies on environment variables, shell execution, file access, and network access, but it does not declare any explicit tool scope or allowed-tools boundary. That increases the blast radius of execution because hosts and reviewers cannot easily constrain what the skill is permitted to do, especially given the instruction that the agent must execute a local Python script.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description says it will use date, city, weather, and style preferences to call an AI wardrobe API, but it does not clearly warn users that their provided context will be transmitted to a third-party external service. This is a privacy and consent issue, particularly in chat environments where users may assume recommendations are generated locally.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and subsequent user-facing messages are written only in Chinese, indicating the skill is designed to communicate in a fixed language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is explicitly justified, which it is not here.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python return False def magick(*args): subprocess.run(["magick"] + list(args), check=True, capture_output=True) # ===== 合成每套搭配 ===== outfit_desc = []
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill auto-opens a generated image using platform-specific desktop commands even though its stated purpose is only to generate and present outfit recommendations. This broadens the skill's behavior into host interaction without explicit consent, which is particularly risky for agent frameworks, remote sessions, and automation pipelines where desktop launch behavior is unexpected and can cause misuse or disruption.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 91% confidence
- Finding
The skill automatically launches the generated file with the local desktop opener, causing side effects on the host outside the stated task of generating outfit recommendations. In agent or server environments, auto-opening local files can trigger unwanted application execution, leak activity to a GUI session, or be abused as an unexpected capability escalation from content generation to host interaction.
- Content
python # ===== 跨平台打开图片 ===== system = platform.system() if system == "Darwin": subprocess.run(["open", str(overview_path)]) elif system == "Windows": os.startfile(str(overview_path)) elif system == "Linux":
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 91% confidence
- Finding
This Linux-specific xdg-open call automatically opens the generated image on the host, which is unnecessary for the core skill purpose and creates an avoidable local side effect. In desktop environments, xdg-open delegates to system handlers and may launch external applications, making the skill more capable than advertised and riskier in shared or automated execution contexts.
- Content
python elif system == "Windows": os.startfile(str(overview_path)) elif system == "Linux": subprocess.run(["xdg-open", str(overview_path)])
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language changelog states that the script is immediately marked ready and provides a 'friendly prompt' in Chinese-facing wording, with the entire file written only in Chinese and no indication that language is configurable or limited to a China-specific deployment. Under the language/locale policy, this suggests a fixed locale presentation without documented user opt-in or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill states that in CLI mode the script will automatically open generated images using a system preview command, but this behavior is not prominently disclosed as a side effect before execution. Automatic opening of local files can surprise users, disrupt workflows, and in some environments trigger unintended application launches or handling of untrusted content.
- Content
Static analysis
No suspicious patterns detected.