T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze_run.py:17- Finding
Unbounded Parsing of User-Supplied XML Files
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Running Coach
Security checks for vulnerabilities and agentic risk
Overview
This Chinese-language running coach skill is coherent and locally scoped, with ordinary coaching and file-parsing risks but no hidden access, persistence, or exfiltration behavior found.
Reasonable to install for Chinese-language running plans and activity summaries. Use it with your own TCX/GPX files or trusted files, avoid very large or untrusted XML uploads, and treat training, injury, caffeine, salt, and fueling advice as general guidance rather than medical advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
描述把技能定位为专业跑步教练，主能力应是训练指导与多类教练建议；而代码仅实现了本地 TCX/GPX 文件解析和基础跑步数据汇总，主用途明显更窄，属于数据分析工具而非完整教练系统。虽然描述中包含“分析跑步数据（TCX/GPX）”，这部分与代码部分一致，但大量核心宣称能力完全未在代码中体现，且 GPX 支持也主要停留在解析层面，没有在分析结果中充分使用。因此描述与实际行为存在实质性不匹配。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description and the document content are entirely presented in Chinese, framing the skill as operating in that language without any opt-in or alternative language handling. Under the policy, a skill should not force a specific language unless it offers user choice or clearly documents a justified locale-specific constraint.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Broad trigger conditions can cause the skill to activate on ordinary running-related conversation even when the user did not intend to invoke it. That can lead to inappropriate handling of user inputs, unnecessary processing of uploaded files, or accidental execution of referenced workflows in a larger agent environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The training-question trigger is underspecified and could match a wide range of generic health, injury, or sports questions. In agent systems, ambiguous activation increases the chance of the skill taking over conversations outside its safe domain and giving overconfident advice without proper constraints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file gives prescriptive fueling, caffeine, and salt-pill guidance for marathon racing without warning that needs vary by body size, medical conditions, GI tolerance, medications, heat, and prior practice. In a coaching skill, users may follow this advice as authoritative, which can contribute to overhydration, GI distress, electrolyte imbalance, or unsafe supplement use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document advises runners to continue through distress states such as 'hitting the wall,' side pain, and cramping, but provides no explicit red-flag criteria for stopping or seeking medical attention. In endurance events, symptoms like severe cramping, dizziness, chest pain, confusion, collapse, breathing difficulty, or worsening pain can indicate dangerous conditions, and omission of stop/seek-help guidance increases harm risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire markdown file is written in Chinese and does not offer an alternative language, translation option, or any indication that the locale constraint is intentional and justified. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire document is written in Chinese and does not indicate that users may choose another language or that the content is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, a skill that effectively enforces a language/locale without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains user-facing natural-language descriptions and output strings in Chinese only, beginning with the module docstring and continuing through CLI help text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire markdown template uses Chinese headings and field labels, which imposes a specific language on users. Under the policy criteria, a fixed language is a natural-language policy concern when the file does not offer user opt-in or explain that the skill is intentionally region- or locale-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
A natural-language policy issue applies here because the skill content forces a specific language for all users and does not present any opt-in or alternative language option. The file does not document that the Chinese-only format is required for a specific region or audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring and all user-facing CLI messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. The policy explicitly calls out language or locale constraints as findings when the skill does not offer user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
SQP-3 applies to all file types and covers language/locale policy violations. The module docstring, CLI description, argument help text, and output strings are all Chinese-only, which effectively forces a specific language without user opt-in or an explanation that this is a region-specific tool.
- Content