T08 · Insecure Dependencies
Warning
- Location
SKILL.md:185- Finding
Execution of Unverified External Skill Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Distill
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for merging skills, but it requires running external local Python tools and can lead to installed-skill changes without enough integrity checks or explicit approval gates.
Review before installing if you do not already trust the referenced improvement-learner, improvement-orchestrator, and improvement-evaluator skills in your local ~/.claude/skills directory. Only run the Phase 4 commands after checking those scripts, and be careful with options that delete, replace, or downgrade existing skills.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 蒸馏 | 新 skill 目录 + learner 评分 | `SKILL.md` (≤500 行) + `references/` (长尾内容) + 评分报告 |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 1. **Collect** -- Read all source skills, build inventory table (lines, sections, references, unique contributions) 2. **Analyze** -- Cross-reference every knowledge point across sources. Classify as intersection / unique contribution / conflict / redundant 3. **Confirm** -- Present distillation plan to user. Conflicts require human decision. NEVER auto-generate without confirmation 4. **Generate** -- Write the distilled skill, then validate via improvement-learner (accuracy >= 0.80 required) ## Directory structure
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger set is broad and overlaps with common user requests about merging, consolidating, or reducing skills, which can cause the skill to activate in situations where the user's intent is ambiguous. In an agent system, over-broad routing can load the wrong skill, leading to unintended file generation, incorrect workflow execution, or chaining into the Phase 4 validation commands described in the skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill reference is written in Chinese and provides no indication that users may choose another language or that the locale restriction is intentional for a region-specific purpose. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content