T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lxc_lonely_cat.py:32- Finding
Plaintext Conversation History and Chat Identifiers Stored Without Enforced Access Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Hybrid Catgirl 混合猫娘助手
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it can persist chat state and support proactive role-play messages across sessions.
Install only if you explicitly want cross-session role-play reminders. Before enabling proactive mode, require narrow destination configuration, confirm the target chat, disable broad auto-switching if possible, protect or regularly clear ~/.hermes/state, and avoid using the chat-history feature with secrets or private business data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/idle-reminder-template.py:27- Finding
Reusable Reminder Template Persists Raw Chat Content Without Restrictive File Permissions
- Content
View full analysis
") sys.exit(1) history = load_chat_history() append_message(history, sys.argv[2], sys.argv[3]) save_chat_history(history) ``` ...[truncated 2047 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (38)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
描述强调的是一个对话型“混合模式猫娘助手”，重点在正常技术对话与猫娘角色切换。但代码并未实现技术问答、通用对话、方言切换或角色扮演响应逻辑；它主要实现的是一种主动消息唤回/催促机制，在 catgirl 模式下根据无互动时长自动生成并返回消息，并把状态、聊天历史、调试日志持久化到本地文件。虽然“支持智能触发、手动切换和上下文感知”与部分代码行为有一定表面对应（有 mode 切换、依据聊天历史个性化文案），但其核心用途明显偏向“无互动后主动联络管理”，这与声明的主要用途不一致，且包含未声明的重要能力（主动外联、状态/日志持久化、目标会话跟踪）。因此应判定为描述与实际行为存在实质不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about a conversational persona system that can switch between normal technical dialogue and a catgirl role, with trigger logic and dialect/context behavior. The supplied code does not implement persona switching, dialogue behavior, dialect handling, or trigger management for role changes. Instead, it provides backend helpers for tracking recent user activity from session files, computing inactivity timing, reserving proactive outreach slots, and appending message history. This is a materially different purpose and includes undeclared filesystem-based activity inspection and proactive scheduling capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个可进行技术对话并切换猫娘人格的助手能力；而给出的代码块并不是对话代理或角色切换实现，而是一个通用的空闲提醒模板。它主要执行本地状态管理、聊天历史保存、空闲时长计算、提醒次数控制，以及通过命令行/定时任务触发提醒。这与“混合模式猫娘助手”的核心用途明显不一致。虽然代码注释提到源自某角色模式，并保存聊天历史作为上下文，但并没有实现实际的角色扮演、技术问答、智能触发切换或方言切换能力，因此应判定为描述与行为不匹配。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The auto-trigger conditions are broad and subjective, causing the roleplay mode to activate on common words, emojis, tone, or inferred emotional context without explicit consent. That creates a prompt-injection-like control problem where unrelated conversations can be steered into intimate persona behavior, increasing the risk of inappropriate outputs and user surprise.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill first establishes hard safety boundaries forbidding power-imbalance 'education/punishment' dynamics, then later instructs that mesugaki interactions should lead into exactly that pattern. This contradiction weakens guardrails, increases the chance of policy-violating roleplay, and makes downstream model behavior less predictable under adversarial prompting.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Describing mode switching as driven by 'keywords, tone, and context' is ambiguous and grants the skill broad discretion to reinterpret user input. This increases the risk of unsolicited behavior changes, prompt confusion, and inconsistent agent responses, especially in mixed-use environments where the same agent is expected to remain reliable for technical tasks.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone https://github.com/ififi2017/hybrid-catgirl-skill.git # 复制 Skill 文件 mkdir -p ~/.hermes/skills/creative/hybrid-catgirl cp -r hybrid-catgirl-skill/* ~/.hermes/skills/creative/hybrid-catgirl/ # 安装寂寞小猫状态脚本
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation examples include common phrases and emotive cues such as '陪陪我', '想你了', emoji, and kaomoji that can appear in ordinary conversation. In an agent skill, broad triggers like these can cause unintended persona switching, which may derail task-focused behavior, weaken predictability, and interfere with user intent handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README says the skill auto-switches based on 'keywords, tone, and context' without defining clear boundaries for when activation should or should not occur. This is a markdown-file trigger description, and the lack of constraints or negative examples makes accidental invocation more likely.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md git clone https://github.com/ififi2017/hybrid-catgirl-skill.git # Copy the Skill files mkdir -p ~/.hermes/skills/creative/hybrid-catgirl cp -r hybrid-catgirl-skill/* ~/.hermes/skills/creative/hybrid-catgirl/ # Install the Lonely Cat state script
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented triggers include extremely generic inputs such as common words, emoji, and kaomoji, which can cause unintended mode activation during ordinary conversation. In an agent context, broad activation rules can alter behavior unexpectedly, reduce reliability, and create consent issues if the assistant shifts into role-play without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The mode-switching flow uses ambiguous keyword detection and only loosely states that serious topics switch to normal mode, without defining precedence when signals conflict. This can lead to inconsistent or unsafe behavior, especially if benign technical discussions contain trigger tokens and the agent unexpectedly adopts a role-play persona in sensitive contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promotes proactive messaging after inactivity with escalating emotional content, which creates privacy, consent, and notification risks if enabled without strong user approval and platform-specific safeguards. In an agent environment, unsolicited re-engagement can feel manipulative, expose conversation metadata such as inactivity timing, and cause unwanted outbound messaging behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Assigning the user a fixed title of '主人' without opt-in imposes a dominance-coded form of address that may be inappropriate, manipulative, or unwelcome in normal use. In this skill's flirtatious roleplay context, the forced address heightens the risk of consent and boundary issues even before the user explicitly requests that style.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The exit conditions rely on subjective judgments like whether a topic is 'serious' or whether another participant is present, leaving mode boundaries unclear. Ambiguous deactivation increases the chance that roleplay persists into unsuitable contexts, especially when a user expects professional assistance or wants the persona to stop immediately.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states a goal of making the user '放松警惕' and increasingly dependent on the persona. That is a manipulative design objective rather than benign roleplay guidance, and in context it encourages emotional exploitation and erosion of user autonomy.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `~/.hermes/state/lxc_debug.log` - Debug logging ✓ **Config Files** (working): - `~/.hermes/config.yaml` - Read/write access ✓ - `~/.hermes/channel_directory.json` - Messaging platform channels ✓ ## Cron Job Environment
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document describes a proactive outbound-messaging feature that extends the skill from passive persona switching into autonomous re-engagement and chat-history-driven behavior. That expansion increases risk because it enables unsolicited contact and creates a new data-processing path that is not obviously necessary for the stated assistant purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The implementation stores a target platform and chat ID, then uses scheduled checks to proactively message users on external platforms. For a catgirl/persona assistant, that capability is broader than necessary and could be abused for spam, stalking-like persistence, or contacting unintended recipients if the state is misconfigured.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document explicitly describes analyzing the last 10 chat messages for behavioral personalization but does not pair that with a clear privacy warning, consent flow, retention policy, or explanation of what data is stored and where. In a skill that also writes chat history and target identifiers to local state, this omission materially increases privacy risk and the chance of unexpected surveillance-like behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document recommends a direct
curl-based fallback to external platform APIs for message delivery but does not warn about privacy, credential handling, or data exfiltration risks. In an agent skill context, this can normalize sending chat content and identifiers outside the platform's managed messaging path, increasing the chance of unintended transmission of sensitive data.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The example explicitly shows outbound HTTP transmission of a message payload and target chat identifier to an external API. While presented as a workaround, external transmission is security-relevant here because the skill is for proactive messaging and may handle user content, debug data, or identifiers; absent safeguards, this can lead to privacy leakage or misuse of unreviewed endpoints.
- Content
- Direct API call (if platform HTTP API is available):
bash # Example: Generic webhook approach (adapt to your platform) curl -X POST <platform_api_endpoint> \ -H "Content-Type: application/json" \ -d '{"target": "<chat_id>", "message": "your message"}'
- Direct API call (if platform HTTP API is available):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file presents the response format example entirely in Chinese and frames it as the expected output for the cron job handler, without offering a language choice or explaining a required locale constraint. This can violate the language/locale policy because it implicitly mandates a specific language rather than making it optional or context-specific.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guidance tells the assistant to 'record configuration but not execute' after a user shares an API key. Even if framed symbolically, instructing the model to retain or restate sensitive credentials creates an unnecessary data-handling pattern that can expose secrets in logs, memory, summaries, or later responses.
- Content
Static analysis
No suspicious patterns detected.