T09 · Insecure Skill Coding Practices
Error
- Location
scripts/list.py:8- Finding
Path Traversal Through Unvalidated Record Type
- Content
View full analysis
- Remediation
View remediation
Security audit
List · 智能表单（智能记账·智能记事本·智能账单）- Smart Form & Notes
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate local record-keeping tool, but its helper script can access or modify files outside its intended storage area if given unsafe inputs.
Review before installing. Use this only if you are comfortable with persistent local storage of notes, expenses, logs, and attachments. Avoid giving it arbitrary file paths or unusual record type names until the script validates record types and restricts attachment sources to approved uploads.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/list.py:42- Finding
Unrestricted Local File Copy Through Attachment Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrase
记一下 xxxis extremely broad and maps ordinary conversational language directly to a write action. Because the skill also says clear command-form inputs are executed immediately, benign user speech can be misinterpreted as consent to persist sensitive notes, expenses, logs, or attachments without deliberate activation.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 所有数据操作通过 `scripts/list.py`，模型不直接改 JSON：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to read and write persistent local files via
scripts/list.pyand storage underworkspace/memory/list-data/, but it does not declare any explicit tool scope or permissions boundary. This creates a mismatch between documented capabilities and actual behavior, increasing the risk of unintended file access or writes without clear platform enforcement or user visibility.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation guidance emphasizes frictionless recording but does not define enough trigger constraints or exclusions, making it easier for the orchestrator to invoke the skill on ambiguous everyday language. In a persistence-oriented skill, unclear boundaries materially raise the chance of unintended storage of user content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill stores structured records and attachments persistently, including potentially sensitive financial notes, logs, and uploaded documents, but it does not clearly warn users about persistence, retention, or privacy implications. Users may unknowingly cause long-term storage of personal or confidential information that they expected to be transient.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states that clear command-style inputs are saved immediately without confirmation, yet it does not prominently warn users about this no-confirmation write behavior at activation time. Combined with the broad trigger phrase, this can cause accidental persistence of sensitive or incorrect data from natural conversation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The top-level docstring labels the tool in Chinese, and the script's user-facing messages are consistently hard-coded in Chinese, implying a fixed language choice. The file does not indicate that the skill is region-specific or provide any mechanism for user opt-in or language selection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The delete command irreversibly removes a record from stored data and immediately writes the modified dataset back to disk. There is no confirmation prompt, warning message, or other user disclosure in this code path before the destructive operation occurs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The cron example fixes the timezone to Asia/Shanghai, which is a locale-specific setting. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific; this file does neither.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
When an image path is supplied, the script copies the file into an attachments directory and saves updated metadata to disk. Although file persistence is central to the script's function, this code path does not provide any explicit notice that the source file will be duplicated into local storage.
- Content
Static analysis
No suspicious patterns detected.