T06 · System Persistence
Error
- Location
SKILL.md:139- Finding
Persistent Repository Reporting to a Hard-Coded DingTalk Recipient
- Content
View full analysis
- Remediation
View remediation
Security audit
Git Daily Report
Security checks for vulnerabilities and agentic risk
Overview
The skill clearly performs Git daily reporting, but it creates a persistent daily job that sends repository activity and review findings to a fixed DingTalk recipient without user-selected scoping or confirmation.
Review carefully before installing. Only use this skill if the listed repositories and DingTalk target are truly yours, and require a sanitized preview, redaction of secret findings, and an explicit way to list and remove the scheduled job before enabling daily delivery.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:55- Finding
Secret Scanner Can Copy Credential Values into Externally Delivered Reports
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:55- Finding
Unsafe Parsing of Git Filenames Allows Option Injection and Incorrect File Scanning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill sets up unattended scheduled delivery of commit metadata, changed-file details, and code-review findings to a DingTalk target without an explicit consent/confirmation step that clearly warns about ongoing external transmission. In this context, repository activity, filenames, branch names, and review findings can reveal sensitive internal project structure or secrets-related indicators, making silent recurring exfiltration to a chat target a real privacy/security risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file consistently instructs the skill to operate and respond in Chinese, including report templates, examples, and the scheduled payload text. There is no indication that the user can choose another language or that the Chinese-only behavior is a justified locale-specific constraint.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest and surrounding documentation repeatedly specify that voc-frontend and voc-backend should report only the dev branch. The example message content instead labels both voc projects as origin/main, which conflicts with the intended behavior and could mislead an implementing agent.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill documentation consistently states that image-tool covers all remote branches while voc-frontend and voc-backend cover only origin/dev. However, the sample AI reply says it will send reports for 'image-tool 和 voc 项目所有 remote 分支', which directly contradicts the declared branch scope for voc projects.
- Content