T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate_dual_view.py:53- Finding
Dual-View Validator Does Not Perform Entry-Scoped or Complete Field Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
知识资产化巧匠
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a coherent document-to-knowledge-base helper, with review-quality and dependency hygiene caveats but no evidence of hidden data theft, persistence, or destructive behavior.
Install only if you are comfortable processing the selected documents locally into reusable knowledge assets. Use it on explicit, authorized inputs, desensitize private or confidential material first, render generated Markdown in a safe viewer with raw HTML disabled, and treat the included validator as a helpful check rather than a complete publication gate.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_markdown.py:43- Finding
Untrusted Knowledge Fields Are Rendered into Markdown Without Sanitization
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/doc_reader.py:10- Finding
Runtime Installation Guidance Uses an Unlocked Third-Party Dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个完整的知识库构建/资料结构化工具，核心价值在于把原始资料转为可检索、可追溯、可更新的结构化知识资产，并具备去重、冲突管理、增量入库等能力。而提供的代码仅实现了读取文本和 Word 文档内容并打印输出的基础功能，没有任何结构化处理、知识抽取、输出双视图、检索优化或知识库管理逻辑。虽然“读取原始资料”可能是上游辅助步骤，但就该代码块本身而言，其实际行为与声明的主要用途存在明显且实质性的不一致。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill explicitly references local file reading and generation of output artifacts, but it does not declare any tool scope such as
permissionsorallowed-tools. This creates a governance gap: the runtime may permit broader file access than users expect, increasing the risk of unintended reading or writing of local data, especially because the skill is designed to process arbitrary source materials that may contain sensitive content.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description claims applicability to 'any raw material' and provides expansive examples, while the exclusions are not enforced at activation time. This weak boundary definition increases the chance that the skill is invoked on inappropriate, sensitive, or unsupported inputs, which is especially risky given the skill's stated handling of documents, transcripts, and institutional materials that may contain private or regulated data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad everyday phrases such as '结构化一下', '拆成知识块', and '喂智能体', which can cause the skill to activate in contexts the user did not intend. Over-broad invocation is security-relevant because this skill is authorized to inspect and transform user materials, so accidental activation could expose sensitive documents to processing workflows or file operations without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance states '采用中文+英文混合（必要时）', which imposes a language/locale convention in natural-language instructions. Under the policy, forcing a specific language pattern without user opt-in or a documented regional justification is a reportable violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language strings and docstrings exclusively in Chinese, including the top-level description and runtime error/help text. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the regional constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-facing error and usage messages in Chinese, including parse errors and CLI help text. Because the file provides no opt-in, fallback, or documented justification for a Chinese-only locale, it violates the language/locale policy for natural-language content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file is entirely written in Chinese and presents the schema and delivery rules as mandatory instructions, but it does not indicate that Chinese is optional or that the skill is specifically limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file includes natural-language strings in Chinese for error and usage/output messaging, such as the parse error text. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the restriction is clearly justified, which is not evident in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script generates all section headings and review guidance in Chinese, which imposes a fixed language on downstream users. The file does not indicate that the skill is region-specific or provide any mechanism for choosing another language, so this matches the natural-language locale policy concern.
- Content