T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:29- Finding
Shell Command Injection Through Unescaped User-Controlled API Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
九赋产品溯源评级
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent product-verification purpose, but it asks for broad shell execution to send user-supplied product data to a third-party API without enough scoping or safe handling.
Review before installing. Use it only if you are comfortable sending product and brand query details to jiufu-trace.cn, and prefer a safer implementation that uses a constrained HTTP client or JSON serializer instead of raw shell curl. Avoid entering sensitive business, purchase, or investigation context unless the data handling of the third-party API is acceptable.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
L004 的描述全文以中文限定技能使用与输出语境，文件中未说明是否支持用户选择其他语言，也未给出必须使用中文的合规或地域性理由。按规则，若技能强制特定语言而无用户选择或明确正当说明，应视为自然语言政策风险。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger guidance includes very broad everyday phrasing like '这个品牌怎么样' and '靠不靠谱', which can cause the skill to activate in loosely related conversations. Over-broad invocation increases the chance that user-provided product or brand details are sent to the external service without sufficiently clear user intent for third-party lookup.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The skill explicitly requires the exec tool and provides a curl command that transmits user-influenced data to an external API endpoint. External transmission is not inherently malicious in this context, but it is a real security/privacy risk because unvalidated user content is sent off-platform and the skill provides no authentication, trust validation, minimization, or consent controls.
- Content
调用方法
使用 curl 调用九赋溯源API：
bash curl -s -X POST https://jiufu-trace.cn/api/cti/verify \
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to send user-supplied product, brand, and category information to an external domain but does not clearly disclose that this information will leave the local system. This creates a transparency and privacy risk, especially if users provide sensitive business, purchase, or investigation context alongside the product details.
- Content