T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kb-llm.py:137- Finding
LLM-Controlled Path Traversal Allows Writes Outside the Wiki Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Huo15 Knowledge Base
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible knowledge-base skill, but its LLM compile path can write files outside the intended wiki folder and it sends raw document prompts to configured LLM endpoints without strong safeguards.
Review this before installing. Use it only with non-sensitive documents or a trusted local/provider endpoint, avoid running compile or lint on untrusted ingested content, and do not use bulk all-agent activation unless you intend to create persistent knowledge-base directories for every agent. The LLM filename path traversal should be fixed before normal use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/kb-llm.py:21- Finding
Unrestricted LLM Endpoint Can Receive API Credentials and Knowledge-Base Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/compile.sh:54- Finding
Untrusted Documents Are Mixed with LLM Control Instructions
- Content
View full analysis
"$CACHE_DIR/compile_prompt.md" << 'PROMPT_EOF' # 编译任务 你是一个研究图书馆员，负责把收集的原始文档编译成结构化百科。 ## 任务 1. 读取以下所有原始文档 2. 为每个文档生成： - **摘要**（50字内） - **关键概念**（3-5个标签） - **百科正文**（整理成 Markdown 格式） 3. 创建**反向链接**（相关条目间互联） 4. 更新 `wiki/index.md` 索引 ## 输出格式 为每个文档，在 `wiki/` 下生成一个 `.md` 文件： ```markdown --- type: paper|article|note title: 标题 source: 来源 date: 日期 concepts: [概念1, 概念2] --- # 标题 ## 摘要 ... ## 核心内容 ... ## 相关概念 ## 原始出处 [链接](url) ``` ## 重要规则 - 所有输出必须是有效的 Markdown - 使用中文撰写摘要和正文 - 关键概念用 `concepts:` 标签列出 - 相关条目用 `[[条目名]]` 格式创建反向链接 - 不要臆造信息，只基于原文整理 ## 开始编译 请读取以下文档并开始编译： PROMPT_EOF ``` It then appends every raw document directly to the same prompt: ```bash while IFS= read -r doc; do echo "### $doc" >> "$CACHE_DIR/compile_prompt.md" echo '```' >> "$CACHE_DIR/compile_prompt.md" cat "$doc" >> "$CACHE_DIR/compile_prompt.md" echo '```' >> "$CACHE_DIR/compile_prompt.md" echo "" >> "$CACHE_DIR/compile_prompt.md" done <<< "$DOCS" ``` ### Technical Analysis Raw document content is untrusted because it may come from user input, copied local files, synchronized memory references, or externally sourced material. The script concatenates that content into the same user message as the operational instructions. Markdown code fences are not a security boundary for an LLM. A document can contain text instructing the model to ignore the compilation task, alter output filenames, fabricate content, or emit specially structured entries. This becomes particularly significant because `scripts/kb-llm.py` parses the model response as a control format and uses model-generated filenames for filesystem writes. Therefore, prompt injection can influen ...[truncated 1563 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个较完整的知识库系统/技能，核心能力包括独立知识库创建与多种知识库操作；但提供的代码片段只是一个“生成 wiki 索引”的辅助脚本。它读取本地 markdown 文件，按 type: paper/article/note 分类生成索引页面，并更新主索引文件，没有显示任何 Agent 隔离逻辑、知识入库流程、查询接口、编译流程、同步机制、体检检查或激活操作。因此代码实际行为与声明用途存在明显的主功能不一致，属于描述与实现不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
代码块的主要用途非常明确：解析 reStructuredText 文档并转换成 Markdown。它处理 RST 指令、表格、列表、标题、内联标记，并可读取相关子模块 rst 文件生成索引。整个实现中没有出现知识库目录创建、Agent 隔离、向量索引、检索、编译构建、同步、健康检查或激活等与声明描述核心能力相符的逻辑。因此这不是“描述涵盖实现细节”的情况，而是主功能层面的明显不一致，应判定为 mismatch。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language instructions and descriptions are effectively limited to Chinese, and the file does not offer an alternative language or indicate that the locale restriction is intentional. This can be a language-policy violation under SQP-3 when a skill forces a specific language without user opt-in.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The manifest documents capabilities that imply environment access, filesystem reads/writes, and network fetching, but it does not declare any tool scope restrictions such as permissions or allowed-tools. In an agent ecosystem, this creates an authorization ambiguity where the skill may be invoked with broader access than users or reviewers expect, increasing the chance of unintended file access, data persistence, or remote content ingestion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Using a generic trigger like "知识库" makes accidental invocation likely during ordinary conversation about knowledge bases. In a skill that can ingest remote content, write local files, and sync memory references, an overbroad activation phrase raises the risk of unintended operations and silent data movement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill claims per-agent isolation, yet its documented memory bridge imports shared reference memory into each agent-local knowledge base. That weakens the isolation boundary: sensitive or policy-bearing shared content may be replicated into agent-specific storage, where it can be surfaced in searches, recompiled, or retained longer than intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation describes ingest and memory-sync behavior but does not warn users that external web content and shared memory references may be copied into the agent-local knowledge base. This omission can lead to unintentional retention of sensitive, copyrighted, or untrusted content, especially because the skill presents itself as isolated and convenient to use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The listed activation triggers lack boundaries, scope constraints, or negative examples, so users and orchestration layers may not know when the skill should or should not activate. Ambiguous invocation rules are risky here because the documented commands include data ingestion, compilation, synchronization, and storage operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt text explicitly states '使用中文撰写摘要和正文', requiring all generated summaries and body text to be in Chinese. This is a natural-language locale constraint, and the file does not offer a user choice or explain a region-specific reason for enforcing Chinese output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script includes its description, usage examples, and later runtime messages entirely in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script contains natural-language comments and output strings entirely in Chinese, such as the title and usage note, with no indication that the skill is region-specific or that users may choose another language. The policy explicitly flags language/locale constraints when they are imposed without opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script writes files using filenames taken directly from LLM output via
os.path.join(wiki_dir, filename)with no validation or normalization. Because the LLM output is fully attacker-influenced through prompt/raw document content, a crafted filename such as../../sensitiveor an absolute path could escapewiki_dirand overwrite arbitrary files on the host, making this more serious than a mere lack of confirmation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script reads the prompt file and sends its full contents to an external LLM provider over the network. In a knowledge-base compiler, prompts commonly embed raw documents, internal URLs, notes, or other sensitive enterprise content, so this can cause unintended data exfiltration if operators are not clearly informed or if provider trust boundaries are misunderstood.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This shell script includes its descriptive comments and all user-facing help/status text in Chinese, and it instructs the downstream LLM task in Chinese as well. That creates a language policy concern because the skill appears to require a specific language without documenting a user choice or a justified locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script builds a prompt explicitly instructing an LLM to directly modify wiki files, while only warning that 'LLM intervention' is needed. This is risky because wiki content is treated as input to the prompt, so prompt-injection embedded in wiki pages could influence the model into making unintended or destructive file edits, and the operator is not clearly warned about that write capability.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document is entirely written in Chinese and does not offer any language or locale choice for users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is documented and justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to ingest a remote URL directly, but provides no warning that this causes the skill to fetch and process untrusted external content. In a knowledge-base skill, that content may later influence indexing, compilation, or downstream LLM behavior, increasing the risk of prompt injection, malicious document ingestion, or unsafe handling of attacker-controlled data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This shell script’s natural-language comments and echoed status messages are entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains user-facing comments and console output entirely in Chinese, including status messages and generated markdown headings. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The operational status messages shown during execution are all Chinese, which means users interacting with the script are required to understand that language. Because the file does not justify a Chinese-only audience or provide an alternative locale, this is a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The script reads provider configuration containing API keys from local files and then uses those credentials in outbound requests. While this is part of LLM access, the file does not include an explicit warning or comment highlighting that sensitive credentials are accessed and used.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language descriptions entirely in Chinese, including the module docstring, and later exposes Chinese-only CLI messages. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation when no justification or language selection is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script prints usage and failure messages only in Chinese, with no fallback or opt-in for other languages. This creates a locale-specific experience that is not documented as region-specific or configurable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This shell script includes its title, usage text, and runtime messages entirely in Chinese, such as the description on L02-L03 and prompts on L34, L42, and L53. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable because the skill does not offer any locale selection or justify a Chinese-only scope.
- Content
Static analysis
No suspicious patterns detected.