T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:60- Finding
Shell Command Injection Through Untrusted Song Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Songwriter
Security checks for vulnerabilities and agentic risk
Overview
This songwriting skill is mostly aligned with its purpose, but it automatically runs local code and sends generated content to an external API using unsafe command and temporary-file handling.
Review before installing. Use this only in an environment where automatic local Node.js execution and submission of generated lyrics to kie.ai are acceptable. The workflow should be changed to require confirmation before network submission, avoid shell interpolation, use a private temporary file or stdin, and either document or remove the extra audio URL modes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:60- Finding
Predictable Shared Temporary File Permits Symlink and Content-Tampering Attacks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises a simple theme-to-song pipeline, but the documented/observed behavior depends on hidden prerequisites and broader generation modes not disclosed in the description. This mismatch is dangerous because it can mislead users and reviewers into granting a skill more capability than they intended, including external API use and generic media-processing flows.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly writes a temporary file and runs a local Node.js script automatically, while also instructing that no user confirmation should be requested. Automatic filesystem and process actions without warning or consent are dangerous because they convert untrusted prompt content into side effects on the host and can trigger external network operations implicitly.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill references an environment variable API key and later directs local script execution, but the manifest does not declare any tool scope or permissions. That creates an implicit capability boundary bypass: reviewers and users cannot clearly see that the skill needs credential and code-execution access before activation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest claims the user only provides a theme, but actual operation also relies on preconfigured credentials and local script execution. That hidden dependency model undermines informed consent and can cause the agent to perform privileged actions the user did not reasonably expect from the description.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says the user only needs to provide a theme for the skill to run fully automatically, but it does not define specific trigger phrases, invocation boundaries, or exclusion conditions. In a manifest/markdown context, this is broad enough to overlap with ordinary conversation about song ideas and could cause unintended invocation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Requiring KIE_API_KEY means the skill depends on credentialed external service access, but that capability is not transparently disclosed in the manifest behavior. Hidden credential requirements increase the risk of accidental secret exposure, unauthorized network transmission, and unsafe deployment assumptions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill requires an API credential and implies data will be sent to an external service, but it does not present a user-facing warning about secret usage or outbound transmission. This is risky because users may unknowingly route generated lyrics or metadata to third parties under a hidden trust model.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs spawning subagents and then executing a local Node.js script, which materially expands the attack surface beyond basic text generation. Chained agent execution plus local process invocation can propagate untrusted content across stages and trigger unintended code or network actions without an explicit trust boundary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction explicitly requires writing a Chinese pop song, which imposes a language constraint on output. There is no opt-in, fallback, or explanation that the skill is intentionally limited to Chinese-language use, so this conflicts with the policy against forced language choice without user consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a narrowly scoped skill that takes a user theme, runs an internal lyric-writing pipeline automatically, and returns a Suno试听链接 without interruption. This script also exposes separate modes to extend existing audio, generate covers from an audio URL, and upload-based continuation, which are materially different behaviors not described in that pipeline.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The request helper transmits prompts, lyrics, titles, tags, and potentially external media references to api.kie.ai without any explicit notice, consent prompt, or redaction step. For a songwriting skill that may handle user-authored creative work or private media URLs, this creates a real privacy and data-handling risk because sensitive content is automatically sent off-box to a third party.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script accepts arbitrary external audio URLs and forwards them to a third-party generation API, enabling user-supplied remote content ingestion outside the stated theme-to-song workflow. In skill context, this broadens the trust boundary and can lead to unintended exfiltration of private media links, processing of unauthorized third-party content, or misuse of the skill as a relay for unreviewed external resources.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The usage examples specify inputs such as "歌名", "歌词+元标签", and "续写歌词", which signals a Chinese-only interaction pattern. There is no accompanying explanation that the tool is region-specific or that other languages are also supported, so the file presents a language/locale preference without opt-in.
- Content
Static analysis
No suspicious patterns detected.