T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:73- Finding
Unrestricted User-Supplied URL Fetching May Enable Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
knowledge-advisor
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated knowledge-base purpose, but it persists untrusted ingested content and uses URL fetching, file mutation, deletion, and shell scripts without enough safeguards.
Install only if you are comfortable letting the skill create, edit, and delete files under a local `knowledge-base/`, fetch user-provided URLs, and run its bundled maintenance scripts. Avoid ingesting untrusted URLs or imported book folders until URL restrictions, prompt-injection handling, metadata validation, and safe JSON/Markdown serialization are added.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Warning
- Location
references/telegram-ux.md:70- Finding
Untrusted Source Instructions Can Poison Persistent Knowledge-Base Context
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
scripts/rebuild-index.sh:57- Finding
Unsafe Metadata Parsing and Serialization Allows Persistent Index and JSON Injection
- Content
View full analysis
"$TARGET/_index.md" << EOF # Knowledge Base Index Last updated: $TODAY | Books: $BOOK_COUNT | Frameworks: $TOTAL_FRAMEWORKS | Languages: $LANG_LIST ## Books | Title | Domains | Frameworks | Lang | |-------|---------|------------|------| $(echo -e "$INDEX_TABLE") ## Application Trigger Index EOF ``` `scripts/rebu ...[truncated 4147 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description is for an end-user-facing knowledge advisor skill with capabilities such as ingesting materials, answering advice questions grounded strictly in ingested books, searching the knowledge base, and providing health/management functions. The supplied code chunk is a maintenance utility script whose purpose is narrowly to reconstruct index files from existing local book folders. It scans directories, parses meta.json fields, counts content statistics, and writes summary/index JSON/Markdown files. While rebuilding index and health files is loosely related to 'KB health' and 'managing extracted knowledge,' it represents only a small backend maintenance task and not the primary declared behavior. The mismatch is material because the code lacks the core interactive advisory, citation, search, and ingestion capabilities described.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full-featured knowledge advisor skill whose primary purpose is to ingest materials, organize knowledge, search it, and provide advice grounded strictly in those sources. The supplied code chunk does not implement any of that advisory/search/ingestion behavior. Instead, it is a maintenance utility specifically for validating knowledge-base directory structure and content health. While the description does mention 'checking knowledge base health,' this script covers only that narrow sub-function. Because the actual code’s primary behavior is much narrower and materially different from the declared overall skill purpose, this is a mismatch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad trigger phrases such as everyday advisory language can cause the skill to activate in contexts the user did not intend, which matters more here because the skill has write/delete and shell-execution-adjacent capabilities. Accidental invocation can lead to unintended file reads, modifications, or maintenance actions in response to ambiguous natural-language requests.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to execute local shell scripts for KB initialization and maintenance, which expands the trust boundary from document handling into command execution. If those scripts are modified, replaced, or unsafe, invoking them can alter files or execute arbitrary local actions under the agent's privileges.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The sync workflow explicitly instructs execution of a rebuild shell script, creating a command-execution path during normal use of the skill. In a hostile or multi-user workspace, a tampered script or unexpected environment state could lead to unauthorized file modification or arbitrary command execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The remove flow chains deletion with shell-script execution, so a user action that appears to be content management also triggers command execution. That combination increases the risk of destructive or unintended side effects if the script behavior is unsafe or the environment has been manipulated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These lines require that extracted content be stored in Simplified Chinese and that application triggers use Simplified Chinese. This imposes a language/locale constraint in the skill instructions without offering user opt-in or explaining that the skill is intentionally limited to a Chinese-only or region-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guidance explicitly requires that all extracted content be stored in Traditional Chinese and that application trigger points use Traditional Chinese. This imposes a specific language/locale requirement in natural-language instructions without indicating user choice, opt-in, or a documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide hard-codes a requirement to add English translations for non-English source materials, which can override user preferences and create unauthorized transformation of source content. In a knowledge advisor that promises strict faithfulness to ingested materials, this can introduce privacy, provenance, and policy-compliance issues if users expect original-language-only handling or if translation is inaccurate or undesired.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template's 'Application Triggers' section only provides generic placeholders like 'Situation where this framework applies' and 'Another situation', without requiring specific trigger phrases, scope boundaries, or concrete exclusions. Although the file later includes an anti-pattern section, these trigger instructions remain too underspecified and could lead to overly broad or inconsistent skill invocation descriptions in derived content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad, natural phrases such as 'advise me', 'how should I handle', and 'apply knowledge', which are common in ordinary conversation and can cause the skill to activate when the user did not intend to invoke it. Because this skill has file read/write and shell access, unintended activation could lead to unnecessary KB reads, ingestion flows, or destructive management actions being initiated in the wrong context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide hard-codes Simplified Chinese storage/output for extracted content and trigger phrases, which can override user language preference and cause incorrect or exclusionary behavior for users expecting English or Traditional Chinese. In a multilingual knowledge advisor, this creates a real policy/quality vulnerability because retrieval, citations, and downstream advice may be biased toward one script, reducing accessibility and potentially corrupting consistency across the knowledge base.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions require that extracted content and application triggers be stored and written in Traditional Chinese. That is a language-policy constraint expressed in natural language, and the file does not indicate that users may choose another language or explicitly opt in to this locale requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The guidance requires adding an English translation after each framework/principle name, which enforces a specific language output regardless of user preference. This is a natural-language locale policy concern because the file does not offer a language choice or explain a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest specifies "language": "en" and does not provide any indication that users may choose another language or that the English-only constraint is justified by a regional or compliance requirement. This can violate language/locale policy when a skill forces a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document states that relationship descriptions should be in the language of the
_cross-references.mdfile, 'typically English for mixed-language KBs.' This imposes a default language choice rather than offering a user or project-level language preference, which is a natural-language locale policy concern.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Line L78 states that all files must support English, Traditional Chinese, and Simplified Chinese. This imposes a specific language/locale scope in natural language without indicating that users can choose other languages or that the restriction is optional or justified as region-specific.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md 1. Suggest 2-4 tags, not 1 (most books span multiple domains) 2. Put the most specific tag first 3. Always ask user to confirm — never auto-commit tags 4. Accept custom tags from the user (not limited to the common list) 5. Store tags in lowercase, hyphenated format 6. Tags are stored in `meta.json` and used for filtering in `_index.md`
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md 1. Suggest 2-4 tags, not 1 (most books span multiple domains) 2. Put the most specific tag first 3. Always ask user to confirm — never auto-commit tags 4. Accept custom tags from the user (not limited to the common list) 5. Store tags in lowercase, hyphenated format 6. Tags are stored in `meta.json` and used for filtering in `_index.md`
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This is a manifest file, so vague or underspecified metadata can matter. The manifest sets "language": "en" but provides no surrounding constraints, alternatives, or negative examples, making the language scope broad and potentially applied by default across contexts without clarifying when other languages are allowed.
- Content
Static analysis
No suspicious patterns detected.