T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/patch_format.py:76- Finding
Predictable Backup Path Allows Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Anthropic Usage
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed report-formatting helper that can patch a user-chosen local script, so it needs care but does not show hidden or malicious behavior.
Install is reasonable if you want this exact Anthropic report format. Run the patch command only against the intended anthropic-report.py file, prefer --dry-run first, avoid privileged execution, and make your own backup when patching files in shared or untrusted directories.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a report-format/reference skill, but its implementation instructions include patching an external script in place and creating backups, which is materially different from passive formatting guidance. This mismatch can mislead users or orchestration systems into granting or invoking code-modification behavior under a benign-looking description, increasing the risk of unauthorized or unsafe file changes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill references file-modifying behavior (
python3 scripts/patch_format.py /path/to/anthropic-report.py) but does not declare any explicit tool scope or permissions boundaries. In an agent environment, undeclared read/write capability increases the chance that the skill is invoked with broader filesystem access than users expect, enabling unintended modification of local scripts or reports.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script accepts an arbitrary filesystem path and will overwrite any existing file whose contents happen to match the regex, while sourcing replacement code from a sibling local file. In an agent or automation context, this creates an unnecessary arbitrary file-modification primitive that exceeds the stated report-formatting scope and could be misused to alter unrelated Python programs or operational scripts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
For a skill whose purpose is report formatting, providing direct arbitrary filesystem patching is overprivileged and increases the blast radius if invoked by an agent on untrusted instructions. The capability is especially concerning because it performs in-place writes to user-supplied paths, making unintended or adversarial code modification more likely in environments where tools can access the local filesystem.
- Content
Tainted flow: 'new_content' from pathlib.Path.read_text (line 69, file read) → pathlib.Path.write_text (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python backup = target.with_suffix(".py.pre-format-patch") shutil.copy2(target, backup) print(f"Backup: {backup}") target.write_text(new_content) print(f"Patched: {target}") print(f"Test: python3 {target}")
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The report formats the current time using a fixed CET timezone and labels the output as CET in the heading. This is a natural-language locale policy issue because it forces a specific regional setting without any visible opt-in or explanation that the tool is intended only for a CET audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This file defines a locale-specific preset entirely in Czech, and the surrounding comments indicate these values are meant to be copied into the active language dictionary. Because no user-choice or opt-in mechanism is visible in this file, it may contribute to forcing a specific language/locale, which matches the policy category for natural-language locale violations.
- Content
Static analysis
No suspicious patterns detected.