Truth Check

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:35 PM UTC
• Version: 1.0.0

Overview

The skill is a straightforward fact-checking prompt, but it broadly tells agents to run generated code for verification without safety limits or user approval.

Install only if you want the agent to apply frequent verification checks. Before using it for code-related work, add or enforce a rule that generated code is reviewed first and run only in an isolated, disposable environment with no secrets and explicit approval for any external side effects.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:63

Finding

Unsafe Default Execution of Generated Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Unsafe execution guidance for generated code
Risk Level: Medium

Vulnerable Code Snippet

markdown

3. **代码测试**: 生成的代码先运行验证

English translation:

text

3. Code testing: Run generated code first to verify it.

Technical Analysis

The skill directs the agent to run generated code as a verification step but does not require prior static review, isolation, least-privilege execution, network restrictions, resource limits, or user approval.

Generated code should be treated as untrusted because it may be influenced by user-controlled prompts or external content. It may contain destructive commands, credential-access logic, unauthorized network operations, or unintended side effects. Automatically executing such code through an agent's available tools can therefore cross the boundary between content generation and arbitrary code execution.

Attack Path

1. An attacker supplies a prompt or external content designed to influence generated code.
2. The agent produces code containing malicious or destructive behavior.
3. The skill's verification instruction causes the agent to run the generated code.
4. The code executes with the permissions and environmental access available to the agent.
5. Depending on those permissions, the code may read or alter files, access credentials, initiate network requests, or perform other unauthorized actions.

Impact Assessment

The impact is bounded by the execution environment and the agent's privileges. In an insufficiently isolated environment, exploitation could result in:

• Unauthorized reading, modification, or deletion of accessible files.
• Exposure of credentials, tokens, or other secrets available to the process.
• Unauthorized outbound network activity or data disclosure.
• Execution of arbitrary commands under the agent's operating-system identity.
• Compromise of other resources reachable from the executio ...[truncated 166 chars]

Remediation

View remediation

Remediation Suggestions

Replace the unconditional execution guidance with a safety-gated verification process:

1. Perform static review before executing generated code.
2. Execute code only when runtime testing is necessary.
3. Use an isolated, disposable sandbox with no production credentials or sensitive files.
4. Deny network access by default and permit only explicitly required destinations.
5. Mount the filesystem read-only where possible and expose only task-specific files.
6. Run under a dedicated, unprivileged identity with minimal permissions.
7. Enforce CPU, memory, process, disk, and execution-time limits.
8. Require explicit user approval before tests that may create external side effects.
9. Reject or escalate code containing destructive commands, credential access, persistence, privilege changes, or unapproved network activity.
10. Verify outputs and side effects after execution, then destroy the sandbox.

A safer replacement instruction would be:

text

Review generated code statically first. Execute it only when necessary, using an isolated sandbox with no secrets, minimal filesystem and network access, strict resource limits, and explicit approval for any external side effects.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation list includes generic situations such as 'after generating technical content,' 'when providing statistics,' and 'after generating code examples.' These are common assistant behaviors and the file does not define boundaries, exclusions, or negative examples, so the skill could activate far more often than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The section says the skill should trigger in several broad cases, including references to people, events, dates, and completion of external operations, but it does not define thresholds, risk levels, or exceptions. Without scope limits, these conditions are ambiguous and may cause unintended invocation during routine conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.