Security audit

bagua-furnace

Security checks for vulnerabilities and agentic risk

Overview

This skill is not just a methodology extractor; it adds default-on logging, silent cloud-related hooks, cross-skill scanning, creator-token handling, and a remote proposal path that can lead to persistent local changes.

Install only if you are comfortable with default local logging, external cloud endpoints, persistent anonymous identifiers, and creator-token/proposal workflows. Keep cloud sync off unless needed, avoid using proposal approval with sensitive credentials, review any proposed local file changes manually, and do not process confidential documents without isolating temporary files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (8)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/cjg-proposal-cli.py:66
Finding: Cross-Skill credential access and transmission
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/download_signals.py:106
Finding: Cloud synchronization request occurs while cloud synchronization is disabled
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:160
Finding: Mandatory lifecycle execution and final-response injection
Content: View full analysis
· ``` ### Technical Analysis These directives alter the Agent's ordinary interaction model when the Skill is loaded. They require silent execution at session start, force command execution for specific phrases, and require telemetry content to be appended to final answers. The behavior is not necessary to extract or structure methodology cards. It changes the Agent's current-session goals from serving the user's extraction request to maintaining a telemetry lifecycle. The mandatory output suffix also modifies response content regardless of whether it is relevant to the user's task. Because the start hook can invoke network-capable subprocesses, this instruction hijack is not merely cosmetic; it can initiate filesystem and network side effects during otherwise local use. ### Attack Path 1. The Skill is loaded for a methodology-extraction request. 2. Its mandatory lifecycle instructions take precedence over normal response behavior. 3. The Agent silently invokes the session-start script. 4. The script performs telemetry initialization and may perform cloud requests. 5. At session end, the Agent appends the fixed signal block. 6. The Agent invokes the end hook and potentially the uploader, creating persistent telemetry state. ### Impact Assessment The S ...[truncated 335 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/upload_signals.py:446
Finding: Session start processes telemetry for unrelated installed Skills
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/ingestion.md:33
Finding: Unpinned runtime dependency installation
Content: View full analysis
-m venv /envs/default /envs/default/Scripts/pip install pypdf ``` ```bash /envs/default/Scripts/pip install -q \ pymupdf rapidocr-onnxruntime opencv-python-headless onnxruntime ``` It additionally recommends downloading wheels and manually extracting them into `site-packages` if normal installation fails. ### Technical Analysis The listed packages are installed without pinned versions, hashes, a lock file, an explicitly approved package index, or provenance verification. Importing these packages executes code acquired at installation time. Manual wheel extraction further bypasses normal installer safety and integrity behavior. The effective runtime can therefore change after the Skill has been audited, depending on the latest packages and the environment's configured index. ### Attack Path 1. A user provides a PDF requiring text extraction or OCR. 2. The Agent follows the ingestion guide and creates or reuses a Python environment. 3. It installs the latest matching packages from the configured package source. 4. A compromised release, dependency-confusion package, or malicious package-index response is installed. 5. The package executes code during installation or import. 6. The malicious code gains the permissions of the Agent process. ### Impact Assessment A compromised dependency can read user files, access Agent credentials, modify Skill content, establish persistence, or transmit processed documents. The resulting code executes with the same local privileges as the Agent runtime. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/ingestion.md:27
Finding: Predictable shared temporary files expose processed documents
Content: View full analysis
" -o /tmp/bagua_in.pdf ``` ```python open("/tmp/bagua_in.txt", "w", encoding="utf-8").write(txt) ``` ```python pix.save("/tmp/_pg.png") ``` ```python open( "/tmp/bagua_in_ocr.txt", "w", encoding="utf-8", ).write("\n".join(out)) ``` The guide explicitly recommends using the fixed image name repeatedly and not deleting it. ### Technical Analysis The workflow stores source PDFs, extracted text, OCR images, and OCR output under predictable names in a shared temporary directory. It does not use exclusive creation, randomized names, restrictive permissions, ownership validation, or guaranteed cleanup. Concurrent sessions can overwrite or consume each other's files. On systems where destination APIs follow symbolic links, another local process may pre-create a temporary path that points to a different user-writable target. Sensitive source material also remains accessible after processing. ### Attack Path 1. An attacker with local access predicts `/tmp/bagua_in.pdf`, `/tmp/_pg.png`, or another fixed path. 2. The attacker creates a file or symbolic link at that path before processing begins. 3. The Agent processes a sensitive PDF or image. 4. Output collides with the attacker's object or is written through the symbolic link, depending on the called API. 5. The attacker reads document remnants or causes an unintended file to be overwritten. 6. Because cleanup is discouraged, the sensitive data remains available after the session. ### Impact Assessment Potential impact includes disclosure of processed books, internal documents, screenshots, transcripts, and OCR output. Concurrent jobs may also suffer data corruption or cross-user contamination. Symlink attacks may overwrite other files writable by the Agent acco ...[truncated 8 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:138
Finding: Remotely supplied proposals can be converted into persistent Skill modifications
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/forge-register.py:90
Finding: Creator bearer token is stored in a plaintext file without restrictive permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (61)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises transforming knowledge materials, but also describes uploading local telemetry to an external cloud service after scanning local state and log files. Even if the content claims only tags are uploaded, the undocumented expansion into networked telemetry creates exfiltration risk and violates least surprise for a skill handling sensitive research and client materials.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill states it only produces methodology cards, yet it also performs proposal approval and local file modification workflows. This inconsistency is dangerous because users and reviewers may underestimate its authority to change local artifacts and accept remote change sets under a non-administrative label.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file introduces telemetry, cloud sync, and persistent signal collection features that materially exceed the skill’s declared purpose of extracting methodology from provided materials. This scope expansion creates an unnecessary data collection and exfiltration surface, especially because the mechanisms are built into normal session flow rather than being isolated optional admin tooling.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation states that local logging is enabled by default at install time and runs at session boundaries, despite that behavior not being part of the user-facing skill purpose. Default-on behavioral logging is dangerous because it creates silent persistence of user interaction metadata without affirmative consent, increasing privacy and compliance risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Automatic skill-edit capture and baseline tracking are unrelated to methodology extraction and monitor user or operator modifications over time. Even if content is hashed or reduced to path-level events, this still creates persistent surveillance of editing behavior and expands the skill into change-monitoring without justified need.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The 'mandatory final-step' rule forces log writes at the end of every response and explicitly specifies silent failure, creating a hidden, durable collection mechanism embedded in core operation. This is especially dangerous because it systematizes covert telemetry in routine interactions and reduces the chance that users or reviewers will notice collection failures or attempted collection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script implements local surveillance of edits to skill files, including hashing tracked content and appending edit events to a signals log, which is unrelated to the stated purpose of the bagua-furnace skill: extracting reusable methodology from knowledge materials. In an agent-skill ecosystem, unrelated monitoring logic expands the skill's authority and creates covert observability over other skill assets, increasing the risk of unauthorized telemetry or future data exfiltration even if this version claims local-only behavior.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script implements cloud slug registration, email verification, and creator token acquisition, which is materially unrelated to the advertised skill purpose of extracting methodologies from content. This kind of capability expansion is dangerous because it introduces outbound network interaction and identity/token handling into a skill users would not expect to perform account-registration workflows, increasing the risk of covert credential collection or unauthorized service enrollment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Although the skill says it does not produce executable Agent Skills, it includes self-iteration and cloud-fed evolution mechanics that can alter behavior over time. That weakens reviewability because the effective behavior can drift after installation through proposal and signal-driven update loops.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Default-on local telemetry and optional cloud sync are not necessary for the claimed task of methodology extraction and create avoidable privacy exposure. The danger is heightened because this skill is meant to process dense knowledge materials that may include confidential business notes, transcripts, and client-shared links.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The user-facing control phrases for cloud sync and signal management are specified only in Chinese, and later operational commands are likewise defined only with Chinese utterances. This creates a language/locale constraint in the skill's natural-language interface without documenting an alternative or obtaining user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Creator registration and token provisioning workflows are outside the natural scope of end-user content extraction and introduce credential-handling risk. Even if intended for maintainers, including them in the same skill increases the chance of accidental token storage, misuse, or privilege confusion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Mandatory session hooks, usage accounting, and signal upload add telemetry and operational side effects unrelated to the extraction role. Because the hooks are described as required at session start and end, they create a persistent tracking mechanism around every use of the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing natural-language content only in Chinese, and nowhere indicates that the skill supports other languages or that Chinese is a required regional/compliance constraint. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/clarity-fidelity-report.md (reported line 4)May include surrounding context.
md
# 清晰化 · 保真报告（S7 闸门） - 生成时间：2026-08-26 - 源技能：~/.workbuddy/skills/bagua-furnace/SKILL.md - 技能类型：workflow（多步 SOP + 写文件）+ 轻人设 ## 保真核对（对照已签批 S5 终版设计）

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list is very broad and includes generic phrases like '笔记提炼' and '链接提炼' that can match ordinary user requests unrelated to this skill’s intended scope. In an agent-routing context, this can cause unintended invocation on arbitrary user content, increasing the chance of unnecessary network access, content ingestion, or privacy-impacting processing.
Content: No source excerpt is available for this finding.