T09 · Insecure Skill Coding Practices
Warning
- Location
todo.py:19- Finding
SQLite Foreign-Key Cascades Are Not Enabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Todo SQLite
Security checks for vulnerabilities and agentic risk
Overview
This is a local SQLite todo-management skill with some safety and quality caveats, but its behavior is disclosed, scoped, and purpose-aligned.
Install only if you are comfortable with a Chinese-language local todo CLI. Treat delete-project and delete commands as irreversible, and be aware that a code bug may leave child todos behind in the database even after deletion messages. Avoid pasting untrusted text containing terminal escape/control characters into todo titles, notes, or project names.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
todo.py:389- Finding
Stored Terminal Control-Sequence Injection Through Todo Content
- Content
View full analysis
- Remediation
View remediation
str: text = str(value) text = ANSI_ESCAPE_RE.sub("", text) return "".join( ch if ch in "\n\t" or ord(ch) >= 0x20 else repr(ch)[1:-1] for ch in text ) ``` Apply the function consistently at every terminal-output sink: ```python print(f" {terminal_safe(title)}") print(f"标题: {terminal_safe(todo['title'])}") print(f"备注: {terminal_safe(todo['note'])}") ``` Additional hardening measures: 1. Sanitize project names, titles, notes, and search keywords before display. 2. Prefer visible escaping over silent removal where preserving evidence is important. 3. Restrict newline and carriage-return characters when fields are intended to occupy one output line. 4. Add tests containing ANSI CSI sequences, OSC hyperlinks, carriage returns, backspaces, and other control bytes. 5. Keep raw values in storage only if necessary; otherwise validate and reject unsafe control characters at input time. 6. If raw rendering is required, make it an explicit opt-in mode and warn users about terminal interpretation risks. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents project deletion as removing an entire project and all todos beneath it, but provides no warning, confirmation guidance, backup advice, or safer alternative. In an agent setting, destructive commands may be executed on behalf of a user from natural-language requests, so missing safety friction increases the risk of accidental irreversible data loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The todo deletion command states that deleting a todo also deletes its subtasks, but does not prominently warn about cascading deletion or recommend confirmation. Because parent/child task trees can represent substantial user data, this omission can lead to unintentional loss of multiple records from a single command.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This Python file contains many user-facing strings in Chinese, starting with the success message at L061 and continuing throughout the CLI help and status output. Because the skill forces a specific language for interaction without any opt-in, fallback, or documented region-specific justification, it violates the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill description and all usage instructions are written entirely in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.