T09 · Insecure Skill Coding Practices
Note
- Location
index.js:104- Finding
Undefined Variable Causes Task Operations to Fail
- Content
View full analysis
- Remediation
View remediation
Security audit
Weekly Report
Security checks for vulnerabilities and agentic risk
Overview
This is a simple Chinese weekly-report/task helper that stores task and report JSON files locally, with some reliability and disclosure issues but no evidence of deception, exfiltration, or unsafe privilege use.
Install only if you are comfortable with a Chinese-language helper storing task and report data as local JSON files in its skill directory. Avoid putting confidential work details into it unless local persistence is acceptable, and expect task add/complete behavior to be unreliable until the lowerMessage bug and completion logic are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述只强调“自动汇总本周工作”的周报生成功能，但实际代码不仅生成周报，还会在技能目录中创建并读写 tasks.json 与 reports.json 来持久化保存任务和报告数据；这属于未声明的资源访问/存储能力。另外，代码的主要交互能力并不只是汇总周报，还包括任务录入、完成状态管理和任务列表查询，实际行为更接近“任务管理 + 周报生成器”。触发词与周报场景基本相关，但实际能力明显超出声明，因此应判定为描述与行为不完全一致。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content, including description and trigger phrases, is entirely Chinese, which implies a fixed language/locale requirement. The file does not state that the skill is China/Chinese-specific or provide any opt-in or alternative language behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger “周报” is also broad and may be used in ordinary discussion, causing accidental invocation of the skill. In the context of a productivity skill tied to local task and report files, unintended activation can expose sensitive work summaries or create/overwrite report artifacts without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger keyword “总结” is extremely broad and can match many normal conversations unrelated to weekly reports. This can cause unintended activation, leading the skill to access or generate report content when the user did not intend to invoke it, which is especially risky because the skill references persistent local work/task data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill persistently stores user task and report content to local JSON files without any disclosure, consent flow, retention policy, or access controls. Because weekly reports can contain sensitive work details, silent local persistence increases privacy risk and may expose confidential data to other local users, processes, backups, or logs on the host system.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code formats dates with the zh-CN locale and the skill’s natural-language description, help text, and outputs are all fixed in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without opt-in or documented justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The help text says users can use "完成 xxx" to mark a task completed, but the implementation here creates a new task object and sets its completed state based on an out-of-scope variable rather than updating an existing task. This actively diverges from the documented intent of marking completion and can cause the advertised behavior to fail or behave differently than described.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The inline comment labels this branch as "添加任务" only, but the condition also routes "完成" commands through the same path. Since the skill documentation presents completion as a distinct operation, this comment misstates the branch's intent and obscures the actual behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language description is entirely in Chinese and presents the skill as a Chinese-language weekly report generator without indicating any user language choice or locale scope. This can violate language/locale policy when a skill implicitly enforces a specific language for general use.
- Content
Static analysis
No suspicious patterns detected.