T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.py:168- Finding
Symbolic-Link Traversal Allows Reads Outside the Analysis Root
- Content
View full analysis
- Remediation
View remediation
Security audit
Code Analyzer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a local code-report generator, but one analyzer can follow project symlinks outside the selected folder and the DDD report path can produce a report without actually analyzing files.
Install only if you are comfortable running a local recursive code analyzer on repositories you trust. Avoid using it on untrusted repositories unless symlinks are removed or sandboxed, and treat generated reports as heuristic summaries rather than authoritative security or architecture reviews.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The English-language capability claims describe deep repository analysis across architecture, execution flow, data flow, business rules, and 20+ languages, but the implementation reportedly performs only partial heuristic matching and may not execute full repository scanning before export. Such mismatch creates a trust boundary problem: operators may treat generated output as authoritative, missing real issues or making unsafe changes based on incomplete analysis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The English-language capability claims describe deep repository analysis across architecture, execution flow, data flow, business rules, and 20+ languages, but the implementation reportedly performs only partial heuristic matching and may not execute full repository scanning before export. Such mismatch creates a trust boundary problem: operators may treat generated output as authoritative, missing real issues or making unsafe changes based on incomplete analysis.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/analyze.py --path /path/to/project --output report.md
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/analyze.py --path /path/to/project --output report.md
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/analyze.py --path /path/to/project --output report.md
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/analyze.py --path /path/to/project --output report.md
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/analyze.py --path /path/to/project --output report.md
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/analyze.py --path /path/to/project --output report.md
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md - [ ] Documentation is adequate - [ ] No deprecated dependencies ## Output Guidelines When generating analysis reports:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises commands that read project files, write output reports, and may rely on external references, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can cause over-broad tool access or ambiguous execution boundaries, increasing the risk of unintended file access, overwrites, or network use beyond what users expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description and nearly all user-facing instructions are written in Chinese, and the file gives no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This creates a language/locale policy concern because the skill effectively imposes a specific language without opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata and module docstring claim deep code analysis capabilities, but this file only implements limited name-based DDD heuristics and does not actually scan the target repository end-to-end. In a security-sensitive agent ecosystem, this overstatement can mislead users or downstream automation into trusting incomplete analysis results, causing important code, architecture, or risk issues to be missed.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The main entrypoint constructs the analyzer and can export a report without performing any repository traversal or analysis first. This creates a deceptive success condition where users receive an apparently valid report that may be empty or meaningless, which is dangerous because it can be consumed as evidence that a codebase was reviewed when it was not.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code writes a Markdown report to a user-specified path, which modifies the local filesystem. While the CLI argument names imply output behavior, the code itself provides no confirmation prompt or explicit warning about creating or overwriting the destination file before performing the write.
- Content
Static analysis
No suspicious patterns detected.