T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clean_c_drive.py:38- Finding
Destructive cleanup can bypass documented preview, confirmation, and recovery safeguards
- Content
View full analysis
- Remediation
View remediation
Security audit
c-cleaner
Security checks for vulnerabilities and agentic risk
Overview
This C-drive cleaner has a legitimate purpose, but its cleanup script can perform destructive deletion without the preview, backup, and confirmation safeguards the skill promises.
Review this skill carefully before installing. Use only dry-run or scan modes unless you have inspected the exact paths it will touch, and do not run cleanup with --yes or aggressive mode unless you accept permanent deletion, including possible Recycle Bin clearing. The skill should be updated to require preview first, remove or restrict confirmation bypass, add exact deletion manifests, implement the promised backup or restore-point behavior, and clearly warn about sensitive path reporting.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill description promises analysis-first, safe, user-confirmed cleanup behavior, but the finding indicates the implemented behavior may instead perform direct deletions and recycle-bin emptying without delivering the advertised analysis safeguards. That mismatch is dangerous because users and orchestrators may trust the declared safety model and invoke a destructive skill under false assumptions, especially on the C drive where system stability and user data are at risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description promises analysis-first, safe, user-confirmed cleanup behavior, but the finding indicates the implemented behavior may instead perform direct deletions and recycle-bin emptying without delivering the advertised analysis safeguards. That mismatch is dangerous because users and orchestrators may trust the declared safety model and invoke a destructive skill under false assumptions, especially on the C drive where system stability and user data are at risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill description promises analysis-first, safe, user-confirmed cleanup behavior, but the finding indicates the implemented behavior may instead perform direct deletions and recycle-bin emptying without delivering the advertised analysis safeguards. That mismatch is dangerous because users and orchestrators may trust the declared safety model and invoke a destructive skill under false assumptions, especially on the C drive where system stability and user data are at risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares operational behavior that implies filesystem access and potentially destructive cleanup actions, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope metadata can let the skill run with broader-than-expected read/write capabilities, increasing the chance of unintended file access or deletion on the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide includes destructive commands such as
wsl --unregister,docker system prune -a,powercfg -h off, andvssadmin delete shadowsthat can permanently remove environments, images, or recovery data. Although some sections are labeled by risk, the document does not consistently require explicit confirmation, backup guidance, or a strong warning about irreversibility, which is dangerous in a disk-cleaning skill where users may copy commands directly.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script advertises 'safe cleanup operations' while also supporting destructive behavior, confirmation bypass via --yes, and aggressive mode actions including recycle-bin emptying. This misleading safety framing can cause operators or higher-level agents to trust and invoke the tool with insufficient scrutiny, increasing the risk of unintended data deletion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's natural-language interface and instructions are entirely in Chinese, including the script description and later user-facing prompts, with no indication that language selection is optional. This can violate language/locale policy when a skill imposes a specific language without user opt-in or justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script performs irreversible file deletion across multiple system and user cache locations immediately, rather than first analyzing usage and presenting candidates for user selection as described by the skill metadata. In an agent context, this mismatch increases the chance of unintended destructive actions, especially because cache and temp paths may contain active-session data, installer state, or files needed for rollback/troubleshooting.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Emptying the entire Windows Recycle Bin is a system-wide destructive action that can permanently remove files the user intentionally retained for recovery. This is particularly risky because it is bundled into an 'aggressive' mode and can be executed non-interactively with --yes, making accidental data loss more likely in automated or agent-driven use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings such as the module docstring, argument descriptions, and status messages exclusively in Chinese. Under the policy rule for language/locale, forcing a specific language without offering user choice or documenting a justified locale constraint is a violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Natural-language strings throughout the file, including the module description, CLI help, and printed report, are exclusively in Chinese, which imposes a specific language on users. The file does not offer a language/locale option or document that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The script recursively scans user folders such as Desktop, Documents, Downloads, Pictures, Videos, Music, and AppData, and emits their paths and size information in the report. Although it is read-only, this behavior inspects potentially sensitive personal locations without an explicit warning in comments, CLI help, or printed disclosure about privacy-sensitive filesystem enumeration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The entire skill content is written only in Chinese, with no indication that the language is user-selectable or that the skill is intended exclusively for a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content