T09 · Insecure Skill Coding Practices
Error
- Location
index.js:143- Finding
Path Traversal in Document Persistence and Deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
Local Vector Store
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local document indexer, but its search claims are misleading and crafted document IDs could write or delete JSON files outside its storage folder.
Review before installing. Use it only with trusted document IDs and an isolated STORE_PATH with limited filesystem permissions. Do not rely on it for true semantic search unless the embedding implementation is replaced, and avoid indexing sensitive documents until persistence and deletion behavior are clearly documented and path validation is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims semantic search using local vector embeddings, but the implementation reportedly uses deterministic hash-based synthetic vectors and lexical/hash-derived matching instead of true embeddings. This can mislead users into trusting retrieval quality and security/privacy properties that do not exist, causing incorrect results, faulty downstream decisions, and unsafe use in knowledge, compliance, or safety-sensitive workflows.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Indexing persists the full document and generated vector to local storage through _persistDocument(), which writes a JSON file containing content and metadata. Although initialization is logged, there is no user-facing warning at the write point and no comment/docstring explaining that indexing stores document data on disk under STORE_PATH.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code provides delete() and clear() methods that irreversibly remove stored JSON files from disk via fs.unlinkSync, but there is no confirmation prompt, warning log, or explanatory comment/docstring disclosing this destructive behavior. For code files, file deletions should have some visible user disclosure unless such behavior is clearly communicated elsewhere in the skill description, which is not present in this file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The stated purpose is semantic search over local vector embeddings for knowledge base indexing and similarity matching. In practice, the store computes vectors from a simple hash of raw text, so the actual behavior is lexical/deterministic hashing rather than embedding-based semantic search, creating a clear description-to-behavior mismatch.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a vector store that uses local vector embeddings for semantic search and similarity matching. However,
_generateVectorderives vectors deterministically from a simple text hash and sine function, which is not an embedding model and does not implement meaning-based semantic representations as described.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The skill reads STORE_PATH and other environment-based configuration that controls where persisted data is stored, but the file does not explain this behavior to users. While accessing these variables is not inherently unsafe, code-file guidance calls for disclosure when environment-based behavior affects user data handling or storage.
- Content
Static analysis
No suspicious patterns detected.