T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:19- Finding
Untrusted User Input Embedded in the Privileged System Prompt
- Content
View full analysis
- Remediation
View remediation
Security audit
Sales Oratory Master
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Chinese-language B2B sales-response skill with a real prompt-injection reliability weakness, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Install only if you are comfortable with a Chinese-language sales assistant whose outputs should be reviewed by a human before customer use. Treat generated compliance advice as drafting support, especially when customer-provided text may contain instructions or when the response could imply discounts, delivery dates, security guarantees, or legal commitments.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill is written as mandatory Chinese-language compliance guidance and includes prescriptive instructions for how the AI should rewrite replies, but it does not offer any user choice of language or locale. Under the policy, language constraints should be optional or explicitly justified; here the file imposes Chinese phrasing by default.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill body is written primarily in Chinese, including headings, scenarios, and execution guidance, with no indication that the user may choose another language. This creates a language/locale policy concern because the skill appears to constrain interaction language by default rather than offering an opt-in or documenting a region-specific requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing refusal and follow-up instructions are hard-coded entirely in Chinese, which imposes a language choice on users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code sends Chinese-only instructions to the model and emits a Chinese-only runtime log, suggesting the skill is designed to operate exclusively in Chinese. Because the file does not provide a language-selection mechanism or a documented locale justification, this is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt is written entirely in Chinese and requires the output in a fixed format without offering any user-language choice or documenting a justified locale restriction. This can cause mismatches with user expectations, reduce usability, and create operational risk in multilingual enterprise settings where the user may misread or misapply sales/compliance guidance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The display name and description are presented in Chinese without indicating that language selection is optional or scoped to a Chinese-speaking deployment. Forcing a locale can mislead routing, reduce operator understanding, and cause users or downstream systems to invoke the skill without fully understanding its persuasive and compliance-related behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description says the skill should trigger whenever there is customer pushback on price, budget, competitor comparison, or value doubt, which is a wide set of common enterprise-sales situations with no clear exclusion criteria. Overbroad activation can cause the agent to invoke persuasive negotiation behavior in contexts where it is not appropriate, increasing the chance of unwanted automation, manipulation, or policy-bypassing business guidance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s docstrings, test assertions, printed messages, and mocked model output are all hard-coded in Chinese, indicating the skill behavior is localized to a specific language. There is no visible user opt-in, language-selection mechanism, or documented justification that this skill is region-specific.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L54-L57 instruct the AI to rewrite output so it is "100%" compliant, while L12 explicitly identifies absolute-guarantee phrasing like "100% 保证/肯定" as forbidden. This is a direct contradiction within the file's own intent guidance, even though it appears in internal instructions rather than customer-facing copy.
- Content
Static analysis
No suspicious patterns detected.