T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/log_fetch.py:38- Finding
Source verification can be forged without performing a network fetch
- Content
View full analysis
- Remediation
View remediation
Security audit
Gold Tracker
Security checks for vulnerabilities and agentic risk
Overview
This gold-tracking skill is coherent, but it needs review because its notification system can run configured commands with the full process environment and can send content externally.
Install only after reviewing config.yaml. Keep the default file notifier unless you trust the destination and command, avoid running it with sensitive environment variables, and enable cron/systemd only if you want recurring network fetches and automatic notifications. Do not rely on fetch_log alone as proof that a source was truly fetched.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/news_collect.py:45- Finding
Untrusted RSS content is placed directly into Agent-consumed analysis context
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (37)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh #!/bin/sh # webhook 通知器示例：把 stdin 正文作为 JSON {"text": ...} POST 到 $WEBHOOK_URL。 # # 依赖：curl + python3（仅用于安全 JSON 转义，无第三方依赖）。 # 成功：curl 返回 0 且 stdout 输出 "SENT"。 # 在 config.yaml 中把本 notifier 的 env.WEBHOOK_URL 换成你的真实 webhook 地址即可。 set -eu
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh #!/bin/sh # webhook 通知器示例:把 stdin 正文作为 JSON {"text": ...} POST 到 $WEBHOOK_URL。 # # 依赖:curl + python3(仅用于安全 JSON 转义,无第三方依赖)。 # 成功:curl 返回 0 且 stdout 输出 "SENT"。 # 在 config.yaml 中把本 notifier 的 env.WEBHOOK_URL 换成你的真实 webhook 地址即可。 set -eu
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
Copying the full process environment into child notifier processes can leak secrets unrelated to notifications, including cloud credentials, tokens, and service configuration. Because notifier commands are externally configurable and may be scripts from the repository, this creates a practical secret-harvesting path if a notifier is malicious or replaced.
- Content
python return False, "", "notifier 缺少 command" use_stdin = bool(notifier.get("stdin", True)) env = os.environ.copy() env["SKILL_ROOT"] = str(paths.ROOT) for k, v in (notifier.get("env", {}) or {}).items(): env[str(k)] = str(v)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The natural-language instructions and required output labels are presented only in Chinese, and the document does not indicate that this locale constraint is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly instructs unattended scheduled execution, data fetching, and outbound notifications, but does not clearly warn the operator that it will perform recurring network activity and send alerts automatically. In an agent context, this can cause unintended external communications, privacy leakage, alert spam, or background resource usage if enabled without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language comments and usage instructions are presented only in Chinese, which imposes a specific language on users without opt-in or explanation. Under the language/locale policy, this is a policy violation unless the locale restriction is explicitly justified or alternatives are provided.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
text # 使用方法： # 1. 把下面的 /path/to/gold-tracker 替换为实际安装路径 # 2. 确保 python3 在 cron 的 PATH 中（或用绝对路径 /usr/bin/env python3） # 3. crontab -e 粘贴以下内容；用 crontab -l 验证 # 4. 运行 python3 scripts/verify.py check 确认「调度已挂载」（心跳检查） # # 说明：脚本入口已做 PATH 引导（common/paths.bootstrap_path），
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
text # 使用方法： # 1. 把下面的 /path/to/gold-tracker 替换为实际安装路径 # 2. 确保 python3 在 cron 的 PATH 中（或用绝对路径 /usr/bin/env python3） # 3. crontab -e 粘贴以下内容；用 crontab -l 验证 # 4. 运行 python3 scripts/verify.py check 确认「调度已挂载」（心跳检查） # # 说明：脚本入口已做 PATH 引导（common/paths.bootstrap_path），
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This curl invocation performs external network transmission of the entire stdin-derived payload to a URL controlled by environment configuration. Even though the behavior is intentional for a webhook notifier, it is still a genuine security-sensitive sink because untrusted or sensitive data can leave the system, especially in automation or agent environments.
- Content
sh MSG="$(cat)" PAYLOAD="$(printf '%s' "$MSG" | python3 -c 'import json,sys; print(json.dumps({"text": sys.stdin.read()}, ensure_ascii=False))')" curl -fsS --max-time "${TIMEOUT:-60}" \ -H 'Content-Type: application/json' \ --data "$PAYLOAD" "$WEBHOOK_URL" >/dev/null
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script reads all stdin content and sends it to an externally configured webhook URL without any validation, redaction, allowlisting, or explicit user-facing disclosure at send time. In an agent skill context, stdin may contain sensitive model output, prompts, tokens, or user data, so this creates a real data-exfiltration channel if the notifier is enabled or misconfigured.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and all CLI messages are written in Chinese, making the skill effectively fixed to a single language for user interaction. The policy requires either user opt-in/choice or a clearly justified region-specific constraint, neither of which appears in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, CLI usage/help text, and later user-facing prints are written in Chinese, which imposes a specific language on users. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The cleanup function deletes archived files with unlink() and removes directories with rmdir(), but the file's top-level description only says 'cleanup expired archives' and does not clearly warn that data will be permanently removed. There is also no confirmation prompt before executing the destructive operation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The defaults hard-code both timezone "Asia/Shanghai" and language "zh-CN", which constitutes a natural-language/locale policy constraint embedded in code. The file does not indicate that users may choose another locale or that this region-specific default is required for a documented compliance or product scope reason.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
build_argv allows any configured command or script under the skill root, and even falls back to executing non-executable files with sh. In a notification component, this is broader than necessary and means a config change can turn message delivery into arbitrary code execution, especially dangerous if config or repository contents are attacker-controlled.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The notifier inherits the full parent environment and also accepts additional configured environment variables, which can expose secrets such as API tokens, credentials, or internal settings to every notifier subprocess. A malicious or compromised notifier can read and exfiltrate these values, making this more than a simple implementation detail.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 89% confidence
- Finding
The code executes notifier commands from configuration via subprocess.run, which gives the skill the ability to run arbitrary local programs as part of notification delivery. Although shell injection is reduced because argv is passed as a list, this still creates a command-execution surface if configuration can be modified by an attacker or untrusted party.
- Content
python success_marker = notifier.get("success_marker", "") or "" try: proc = subprocess.run( argv, input=message if use_stdin else None, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code executes configured notifier commands via subprocess and passes the notification message through stdin or command arguments, which can transmit user or system data to external tools. While there is internal logging of success/failure later, there is no confirmation prompt, user-facing disclosure, or explanatory warning in comments/docstrings at the point of execution about this outbound transmission behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains user-facing natural-language text exclusively in Chinese, including the module description and later warning messages, with no indication that the user can choose another language. The policy for this audit flags language/locale constraints when a skill effectively forces a specific language without opt-in or clear region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s user-facing natural language and operational instructions are entirely in Chinese, including mandatory behavior statements such as 'MUST 立即调用本脚本'. Under the policy, forcing a specific language without user opt-in or a clearly documented justified locale constraint is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is entirely in Chinese, and the script's user-facing status messages are also emitted only in Chinese. This imposes a specific language/locale on users without any documented opt-in, fallback, or indication that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains its primary documentation and CLI output in Chinese only, including the usage block and subsequent status/error messages. Under the policy rule for language or locale, this is a violation because the skill does not offer a language choice or explain a justified region-specific restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, usage text, and user-facing output strings are written in Chinese, and the code does not indicate any user opt-in or configurable language selection. This can violate language/locale policy when a skill forces a specific language for all users without offering a choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language instructions, usage text, and runtime messages in Chinese only, including the module docstring and user-facing prints. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern unless the locale restriction is clearly justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The config hard-codes both timezone "Asia/Shanghai" and language "zh-CN" as defaults in natural-language-facing settings. Under the policy rule, forcing a specific language or locale without opt-in or clear region-specific justification is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.