T09 · Insecure Skill Coding Practices
Warning
- Location
references/video-poster-workflow.md:22- Finding
Unrestricted User-Controlled Video URL Retrieval May Enable SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
拾光册视频海报与记忆手帐
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a disclosed video-poster and journal workflow, but it needs review because it can direct an agent to fetch arbitrary video URLs without clear network-safety limits.
Install only in an environment that routes media fetching through a sandboxed downloader or proxy that blocks private, loopback, link-local, metadata, and redirected internal destinations, and enforces size and timeout limits. Review the Chinese-language scope and make sure any archive, delete, or optimization workflow remains user-confirmed and privacy-bounded.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest and body promise broad capabilities such as video ingestion, evidence extraction, rendering, provenance auditing, and user-data optimization, but the described implementation appears unable to perform many of them. This mismatch is dangerous because downstream users or orchestrators may trust outputs as if those controls and analyses actually occurred, leading to false assurance, privacy mistakes, or unsafe automation decisions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 关键帧元素、手帐、归档或找回：读 [references/workflow-playbook.md](references/workflow-playbook.md)；涉及产品/来源边界时再读 [references/product-principles.md](references/product-princip
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 实现或交接结构化数据：读 [references/data-contracts.md](references/data-contracts.md)。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 实现或交接结构化数据：读 [references/data-contracts.md](references/data-contracts.md)。
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata explicitly includes '对抗审稿' (review evasion) as a supported use case, and the workflow broadly operationalizes content transformation, editing, and iterative refinement. Even though the playbook itself focuses on journaling/poster creation, retaining an adversarial-review objective in this context enables misuse to disguise or optimize content for bypassing human or platform review, which is unrelated to the legitimate function of the skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest states the skill may be used to '利用用户数据优化功能效果', but the playbook is framed as content creation, provenance tracking, archival recall, and collection management. There is no bounded, purpose-limited treatment of user-data optimization; this introduces a separate behavioral capability involving user data exploitation beyond the core creative workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly includes “利用用户数据优化功能效果” as an invocation condition, which broadens the skill’s activation scope into privacy-sensitive territory without stating clear consent, minimization, or purpose limits. In an agent setting, this can cause the skill to be invoked for user-data-driven optimization workflows that exceed user expectations or process personal content unnecessarily.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares no explicit tool scope or allowed-tools boundary, yet it instructs the agent to read multiple local reference files. In an agent environment, missing scope declarations can cause the model to access a broader file surface than intended, increasing the risk of unintended data exposure or prompt-driven file enumeration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest includes a broad trigger phrase such as '利用用户数据优化功能效果,' which can activate the skill for generic requests involving user data. In context, that widens the chance that sensitive-data handling workflows are invoked without clear user intent, increasing privacy and data-minimization risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill instructions and user-facing content are entirely in Chinese, and the behavior explicitly centers Chinese typography and text handling without stating that users may choose another language. Because no opt-in or language-selection mechanism is documented, this creates a locale/language policy concern under the natural-language policy rules.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The display name, description, and default prompt are entirely in Chinese, which suggests the skill may operate in a fixed language or locale. There is no visible indication that users can opt into another language or that the locale restriction is intentional and documented for a region-specific use case.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest is broadly scoped around turning video stories into posters and memory journals, but it does not define clear activation boundaries, input constraints, or disallowed adjacent use cases. In an agent-routing context, this can cause the skill to trigger for loosely related poster, video, or image-editing requests, increasing the chance of unintended data exposure, misuse of editing features, or invocation in higher-risk contexts referenced by the skill metadata.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains schema example content in Chinese (
诗与远方) and later mixes additional Chinese-only example values and instructions, but nowhere indicates that Chinese is optional or that users may choose another language. That can violate a language/locale policy when a portable contract is presented as a common handoff format without explicit user opt-in.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The portable contract examples use Chinese values for titles and evidence fields, and later include Chinese text in
focus, story copy, recall queries, and artifact titles. Because this is presented as a general-purpose portable data-contract reference, forcing one language in examples and literal values without documenting locale scope or opt-in may conflict with organizational language-choice policy.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file’s instructions are written as a mandatory Chinese-only workflow and repeatedly require accurate Chinese output, such as '最终准确中文', without any indication that users may choose another language or locale. This is a natural-language policy issue because it imposes a specific language by default rather than offering opt-in or documenting a region-specific need.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The phrase 'when the user asks to improve a feature from real usage' is broad and could overlap with many ordinary product-improvement requests, making it unclear when this workflow should activate versus a general analysis or product iteration skill. The line gives examples but does not define a tight trigger scope or exclusion conditions to prevent unintended invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown instructs the skill to produce copy using specific Chinese character counts and gives Chinese-only phrasing guidance, which effectively forces a language/locale choice. Because no user opt-in or alternative language path is provided, this is a natural-language policy issue under the language/locale rule.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
text permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The natural-language instructions and usage guidance are presented only in Chinese, and there is no indication that the skill supports multiple languages or is intentionally limited to a Chinese-only audience. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This principles file presents core product guidance in Chinese at L05 and then switches to English at L09 without indicating whether the skill supports multiple languages by user choice. That can create an implicit language policy inconsistency for users or implementers consuming the document.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown file includes bilingual section headings such as 'Portrait · 人像摄影' and similar labels throughout, but it does not state whether the user can choose language or locale preferences. Under the policy rule, language presentation that defaults to a specific language style without opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This JSON manifest contains natural-language content in Chinese for both the approved and rendered title fields. Because SQP-3 applies to all file types, hard-coding a specific language without any visible opt-in or documented locale constraint can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON test file contains user-facing natural-language prompts in Chinese across all cases, but there is no indication that Chinese is optional, user-selected, or required for a region-specific purpose. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.