T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scan.sh:37- Finding
Command Injection Through an Unquoted Repository Path in CodeQL Build Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
codeql-skill
Security checks for vulnerabilities and agentic risk
Overview
This CodeQL skill is mostly coherent, but its scan mode can execute repository build commands and has an unsafe command-construction issue that users should review before installing.
Review this skill before installing. Use scan mode only on trusted repositories or inside a disposable sandbox with no secrets in the environment, avoid repository paths containing shell metacharacters, and treat generated Markdown reports as containing untrusted SARIF evidence rather than trusted instructions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/audit.py:68- Finding
Untrusted SARIF Content Is Rendered as Active Markdown
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code is clearly focused on one narrow function: analyzing the text of a provided .ql query file and producing a checklist-based optimization report. This partially matches the declared 'QL query optimization' aspect, but the declared purpose substantially overstates functionality by claiming a full CodeQL security audit pipeline with static scanning and SARIF triage. There is no code to invoke CodeQL, scan codebases, parse SARIF, interact with LGTM/GitHub Code Scanning, or analyze vulnerabilities beyond simple regex/substring checks inside a query file. Thus the description does not accurately represent the actual behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and invokes scripts that read from repositories and write outputs (for example SARIF and reports), but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope metadata can allow the skill to be invoked without adequate user awareness or policy enforcement around filesystem access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases include broad requests such as "scan this repo" and "analyze this vulnerability," which can cause the skill to activate outside a clearly bounded CodeQL context. Because the skill can launch scripts that perform scanning and write artifacts, overbroad routing increases the chance of unintended execution on sensitive repositories or files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The scan mode states it performs language detection, build command selection, database creation, scanning, and SARIF generation, but it does not warn users that this executes build/scan operations and writes artifacts in the target repository context. Running builds on untrusted code and creating outputs can have security and operational consequences, especially in a security-audit skill likely to be pointed at arbitrary repositories.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring, CLI description, and generated report content are written entirely in Chinese, and the script emits Chinese-only user-facing messages and report headings. This imposes a specific language/locale on all users without offering an opt-in choice or documenting a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The report renderer hard-codes all section titles, labels, warnings, and remediation placeholders in Chinese. Because these strings are part of the skill's user-facing behavior and no alternative locale is offered, the file forces a language choice without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains user-facing natural-language documentation and output strings exclusively in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language or justification is provided here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This shell script's natural-language comments, usage text, and runtime messages are entirely in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language is offered. The policy applies to natural-language content in code files, including comments and string literals.
- Content
Static analysis
No suspicious patterns detected.