T09 · Insecure Skill Coding Practices
Warning
- Location
scoring-history.json:1- Finding
Private Note Metadata Included in the Distributable Artifact
- Content
View full analysis
- Remediation
View remediation
Security audit
flomo笔记打分技能
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent, but the published package includes private note-scoring metadata that its own README says should stay local.
Install only if you are comfortable giving the agent broad access to Flomo notes and saving rating history locally. The publisher should remove scoring-history.json from public packages and provide reset/deletion guidance before this is treated as low-risk.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly states that the skill will display full note contents and store complete scoring history including original note text, yet it provides no user-facing warning, consent flow, retention policy, or handling guidance for potentially sensitive personal data. In this context, the notes are likely personal knowledge-management content, so exposing and persisting raw note text increases privacy risk, accidental disclosure risk, and the chance that downstream tooling or logs capture sensitive information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly requires complete display of randomly selected flomo note content, but provides no privacy screening, redaction, or sensitivity warning. Because personal notes commonly contain secrets, intimate content, or regulated data, indiscriminate full display can expose sensitive information to unintended viewers or downstream systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill stores scoring history and continuously updates local files without informing the user that their ratings, rationales, and derived preferences will persist. Persistent storage of behavioral data can create a privacy risk, especially if the files are later accessed by other tools, users, or sessions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The title and entire grading rubric are written exclusively in Chinese, and the file provides no indication that other languages are supported or that Chinese is a justified regional constraint. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description is written entirely in Chinese and presents the skill as a Chinese-language experience without offering any language choice or documenting that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy requirements when users are not given an explicit opt-in or justified regional constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON file contains a natural-language privacy note only in Chinese: "笔记内容已屏蔽，仅供统计分析使用". For a generally scoped skill/config artifact, hard-coding a single language without offering locale choice or documenting that the file is intended for a Chinese-only context can violate the language/locale policy.
- Content
Static analysis
No suspicious patterns detected.