T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/collect_bp_month_evidence.py:505- Finding
API Credential Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
BP Monthly Report Writer
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherently built for BP monthly report drafting, but it needs review because its helper scripts handle internal report data and credentials and can write or overwrite files with weak path controls.
Install only for a trusted BP reporting environment. Use a dedicated least-privilege API key, avoid putting the key in shell history or shared scripts, write outputs only to a private dedicated directory, and do not run the artifact builder on untrusted run directories until path containment and safe YAML parsing are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_scheme_v2_monthly_reports.py:737- Finding
Path Traversal Through Unvalidated Report Directory Components
- Content
View full analysis
Path: run_dir = root_dir / f"{bp_period}_{owner_name}" / report_month run_dir.mkdir(parents=True, exist_ok=True) write_intake(run_dir / "00_intake.yaml", bp_period, period_id, report_month, owner_name, group_id, org_path) anchor_map = build_anchor_map(app_key, period_id, group_id) (run_dir / "01_bp_anchor_map.yaml").write_text(json.dumps(anchor_map, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") ``` The relevant values are accepted through command-line arguments: ```python parser.add_argument("--bp-period", required=True) parser.add_argument("--report-month", required=True) parser.add_argument("--person", action="append", default=[], help="name|groupId|orgPath or name|groupId or groupId") parser.add_argument("--root-dir", required=True) ``` ### Technical Analysis The output directory is assembled from `bp_period`, `owner_name`, and `report_month` without rejecting path separators, absolute paths, `.` components, or `..` components. These values can originate from command-line input, while a resolved owner name can also originate from BP API data. After constructing the path, the script creates directories and writes numerous predictable files, including intake data, anchor maps, evidence manifests, cards, review queues, and final reports. Python's `pathlib` does not automatically confine a composed path beneath the intended root. In particular, traversal components can escape the selected report root, and an absolute later component can discard preceding path components. The script runs with the invoking process's filesystem privileges. Therefore, confinement ...[truncated 1475 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/build_dual_report_artifacts.py:58- Finding
Potentially Unsafe YAML Deserialization Through Ruby
- Content
View full analysis
object: ruby = ( "require 'yaml'; require 'json'; " f"data = YAML.load_file({json.dumps(str(path))}); " "puts JSON.generate(data)" ) raw = subprocess.check_output(["ruby", "-e", ruby], text=True) return json.loads(raw) ``` The file location is selected from the supplied run directory: ```python parser.add_argument("--run-dir", required=True) args = parser.parse_args() run_dir = Path(args.run_dir) anchor_map = load_yaml_via_ruby(run_dir / "01_bp_anchor_map.yaml") ``` ### Technical Analysis The script launches Ruby and passes `01_bp_anchor_map.yaml` to `YAML.load_file`. The security behavior of this method depends on the installed Ruby and Psych versions. In environments where `YAML.load_file` permits arbitrary tagged-object deserialization, a crafted YAML document can instantiate unexpected Ruby classes before the result is converted to JSON. The subprocess call does not use a shell, and the file path is encoded using `json.dumps`, so direct shell-command injection through the path was not found. The risk instead arises from processing attacker-controlled serialized content with a loader whose safety guarantees vary by runtime version. The project itself writes `01_bp_anchor_map.yaml` as JSON-compatible data. Consequently, invoking a Ruby YAML deserializer is unnecessary and expands the attack surface beyond the declared report-generation requirements. ### Attack Path 1. An attacker creates or modifies a run directory accessible to the victim. 2. The attacker places a crafted `01_bp_anchor_map.yaml` in that directory. 3. The victim runs: ```bash python scripts/build_dual_report_artifacts.py --run-dir ATTACKER_CONTROLLED_DIRECTORY ``` 4. The Python script launches the lo ...[truncated 962 chars]- Remediation
View remediation
object: return json.loads(path.read_text(encoding="utf-8")) ``` 2. If actual YAML support is required, use a safe loader that permits only primitive mappings, sequences, strings, numbers, booleans, and null values. 3. If Ruby must remain in use, replace `YAML.load_file` with `YAML.safe_load_file` and do not permit custom classes, symbols, or aliases unless strictly necessary. 4. Validate the resulting schema before use, including expected object types and required fields. 5. Restrict `--run-dir` to a trusted report root and verify path containment. 6. Refuse symbolic links or files not owned by the expected account when operating in a shared environment. 7. Pin and document the supported Ruby/Psych version if the Ruby dependency cannot be removed. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md 4. exposed risks or blockers 5. action progress as support only Do not judge the light only from action count. ## Default rules
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md 4. exposed risks or blockers 5. action progress as support only Do not judge the light only from action count. ## Default rules
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md 4. exposed risks or blockers 5. action progress as support only Do not judge the light only from action count. ## Default rules
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill hard-codes a Chinese opening pattern and strongly implies Chinese-language interaction without checking the user's language preference. This can override user intent, reduce transparency, and cause incorrect or inaccessible outputs in multilingual environments, especially when the user expects another language for business or compliance reasons.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This file is explicitly a Simplified Chinese skill description (
business-description.zh-CN.md), and the content is entirely written as if Chinese is the required interaction/output language. There is no indication that users may choose another language, nor any justification that the skill is region- or compliance-bound to Chinese only.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file is written as a Chinese-language skill design document and labels the artifact as a Chinese locale variant (
zh-CN) without any indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document prescribes specific Chinese field labels and output wording such as
本月总体判断and对下月的总体判断, and later provides additional Chinese-only rendering patterns. For a general writing-conventions reference, this imposes a specific language/locale on users without stating that the skill is region-specific or offering a language choice.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes required section names in Chinese and instructs the writer to use them as fixed report structure. Because the file does not offer a language or locale choice, and no region-specific justification is provided, it appears to enforce a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The summary section requires additional Chinese headings and ties report generation to that language-specific structure. This reinforces a language policy constraint, but the file does not explain that the skill is limited to a Chinese-language workflow or provide a user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The rendering rules require final user-facing report lines and human-review prompts to use fixed Chinese text such as “判断理由”, “人工判断”, and subtype prompts. This imposes a specific language on outputs without user opt-in or any documented region-specific justification, which matches the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file includes user-facing response guidance and examples exclusively in Chinese, presenting that phrasing as the preferred interaction pattern. Because the workflow does not mention any user language preference, opt-in, or locale-specific justification, this can violate a language/locale policy requiring user choice.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python f"data = YAML.load_file({json.dumps(str(path))}); " "puts JSON.generate(data)" ) raw = subprocess.check_output(["ruby", "-e", ruby], text=True) return json.loads(raw)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def api_post(app_key: str, endpoint: str, payload: dict) -> dict: resp = requests.post( f"{BASE_URL}{endpoint}", json=payload, headers={"appKey": app_key, "Content-Type": "application/json"},
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script persists report-derived titles, authors, reply excerpts, node comments, task IDs, timestamps, and extracted progress facts into a local Markdown manifest. Because the source data appears to come from internal work-report systems and may contain sensitive operational or personnel information, writing it to disk without minimization controls, redaction, encryption, or an explicit warning increases the risk of unintended local disclosure and downstream sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code performs requests.get() calls to an external API using the supplied app key in headers and period/group identifiers in query parameters, but the file contains no warning comment, docstring notice, or runtime message explaining that these values are sent over the network. For code files, outbound transmission of potentially sensitive system or organizational data should have some visible disclosure unless already clearly documented.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python users = task_obj.get("taskUsers") or [] names = [] for user in users: for emp in user.get("empList") or []: name = emp.get("name") if name: names.append(name)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
In this code file, the script retrieves remote data and persists it with output.write_text(), but there is no prior confirmation prompt, warning comment, or user-facing disclosure that data will be written to disk. Because the payload includes goal, owner, and assignee information, silently creating or overwriting a file can affect user data handling expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script generates and persists multiple Markdown, YAML, and manifest files containing employee names, organizational paths, group IDs, report links, progress facts, replies, and review content to an arbitrary output directory without any consent prompt, data-classification warning, redaction step, or access-control enforcement. In this skill context, the data is clearly business-operational and personnel-related, so unattended batch export materially increases the risk of accidental disclosure through shared folders, source control commits, backups, or downstream processing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file includes a required example link label in Chinese (
工作汇报标题) but does not indicate that the skill is limited to a Chinese-language environment or give users an option to choose another language/locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown file contains natural-language references whose visible titles are only in Chinese, while the rest of the document is in English. Because the skill does not indicate that Chinese-language materials are required or offer an alternative language path, it may impose a language constraint without user opt-in.
- Content
Static analysis
No suspicious patterns detected.