skill-craft

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:10 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a legitimate skill-authoring helper, but its packaging script can include files outside the skill folder through symlinks.

Review before installing. Use the packaging script only on skill folders you trust, inspect archives before sharing, and remove or reject symlinks until the packager is fixed to verify that every archived file resolves inside the skill directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/package_skill.py:74

Finding

Arbitrary Local File Disclosure Through Symlink Following During Skill Packaging

Content

View full analysis

Vulnerability Details

File Location: scripts/package_skill.py, lines 74-83
Vulnerability Type: Symlink-based local file disclosure
Risk Level: High

Vulnerable Code

python

try:
    with zipfile.ZipFile(skill_filename, "w", zipfile.ZIP_DEFLATED) as zipf:
        # Walk through the skill directory
        for file_path in skill_path.rglob("*"):
            if file_path.is_file():
                # Calculate the relative path within the zip
                arcname = file_path.relative_to(skill_path.parent)
                zipf.write(file_path, arcname)
                print(f"  Added: {arcname}")

Technical Analysis

The packaging routine recursively enumerates files under a user-selected Skill directory and adds every path for which Path.is_file() returns true. It does not reject symbolic links or verify that each file's resolved target remains inside skill_path.

For a symbolic link to a regular file, both Path.is_file() and zipfile.ZipFile.write() follow the link. Therefore, a Skill directory can contain a link whose apparent archive path is inside the Skill while its target is an arbitrary readable file elsewhere on the host.

The validation performed before packaging does not mitigate this issue. validate_skill() checks the SKILL.md frontmatter but does not inspect package contents, reject symbolic links, or enforce resolved-path containment.

Attack Path

1. An attacker prepares a Skill directory with a valid SKILL.md.
2. The attacker adds a file symlink inside the Skill, such as assets/secret, pointing to a sensitive host file such as /home/user/.ssh/id_rsa or a project credential file.
3. The victim runs scripts/package_skill.py against the attacker-controlled Skill directory.
4. skill_path.rglob("*") discovers the symlink.
5. file_path.is_file() follows the symlink and accepts it because its target is a regular file.
6. `zipf.write(file_path, ar ...[truncated 882 chars]

Remediation

View remediation

Remediation Suggestions

1. Reject symbolic links before packaging:

   python

   if file_path.is_symlink():
       raise ValueError(f"Symbolic links are not permitted: {file_path}")
   

2. Resolve and validate every candidate path before reading it:

   python

   root = skill_path.resolve()
   
   for file_path in skill_path.rglob("*"):
       if file_path.is_symlink():
           raise ValueError(f"Symbolic links are not permitted: {file_path}")
   
       resolved = file_path.resolve(strict=True)
       if not resolved.is_relative_to(root):
           raise ValueError(f"Path escapes skill directory: {file_path}")
   
       if resolved.is_file():
           arcname = file_path.relative_to(skill_path.parent)
           zipf.write(resolved, arcname)
   

3. Perform the same symlink and containment checks during validation so unsafe packages fail before archive creation.

4. Avoid placing the output archive inside the source Skill directory. Explicitly reject an output path contained by skill_path to prevent recursive or unintended archive inclusion.

5. Where race-resistant handling is required, open files using operating-system primitives that prohibit symlink following, such as O_NOFOLLOW on supported platforms, and archive from the verified file descriptor.

6. Add regression tests covering:

   • Symlinks to files outside the Skill directory
   • Symlinks to files inside the Skill directory
   • Broken symlinks
   • Directory symlinks
   • Output archives placed inside the source directory
   • Paths changed between validation and packaging

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description promises a substantive skill-design assistant with two modes: CREATE from scratch and OPTIMIZE for existing skills using evidence-based diagnostics and improvement methods. The supplied code only initializes a new skill folder from a static template and optionally creates resource directories and example files. It does not inspect existing skills, analyze SKILL.md quality, optimize prompts, apply the stated 9 dimensions, reference research/guides, or update/fix existing skills. While the initializer partially aligns with the 'create skill' aspect at a basic scaffolding level, the primary behavior is much narrower and omits the major declared capabilities, so this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

There is a clear mismatch between the declared purpose and the supplied code. The description promises an assistant for creating and optimizing AgentSkills, including diagnosis and design improvement across nine dimensions. The actual code instead performs filesystem operations: checking for a folder and SKILL.md, calling a validator, and packaging files into a zip-based .skill artifact. This is not merely an implementation detail of skill optimization; it is a distinct utility with a different primary purpose. The declaration does mention 'package skill' among trigger phrases, but the substantive description does not state that the skill packages directories into distributable archives or behaves as a CLI tool. Therefore the behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

"skill not working", "skill design", "SKILL.md", "写技能", "优化技能",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/skill-optimization.md (reported line 188)May include surrounding context.

md

- GET /api/users/:id — Get user by ID (returns User)
- POST /api/users — Create user (body: CreateUserDTO, returns User)
- PUT /api/users/:id — Update user (body: UpdateUserDTO, returns User)
- DELETE /api/users/:id — Delete user (returns void)
See references/api.md for more details.

# ✅ AFTER: SKILL.md 只保留摘要，详情在 references

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/init_skill.py (reported line 336)May include surrounding context.

python

# Print next steps
    print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    if resources:
        if include_examples:
            print(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains broad phrases such as "improve skill," "fix skill," and "skill design," which can cause the skill to activate on ordinary conversation about skills rather than explicit requests to create or modify an AgentSkill package. Overbroad triggering can misroute user intent, inject lengthy instructions into unrelated tasks, and increase the chance that file-writing or shell-oriented guidance is applied in the wrong context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents its substantive instructional content in Chinese despite an English title and without offering a language option or stating that the skill is intentionally region-specific. That creates a natural-language policy risk because it effectively imposes a locale/language on readers or downstream skill authors without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The sentence on L003 presents the guide content in Chinese and states that an AI agent can immediately use it to optimize skills after reading it, but nowhere in the document is there an option for the user to choose language or a justification that this skill is intentionally region-specific. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/skill-optimization.md (reported line 443)May include surrounding context.

markdown

# ❌ BEFORE: 三条否定约束堆叠
Never modify files outside the project directory. Don't use deprecated APIs.
Avoid adding new dependencies without approval.

# ✅ AFTER: 三条独立正向约束
- Only modify files within the project directory

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/skill-optimization.md (reported line 455)May include surrounding context.

markdown

# ❌ BEFORE: 纯否定，agent 不知道该做什么
CRITICAL: Never delete files without asking the user first. Don't modify
production configuration files.

# ✅ AFTER: 保留安全否定 + 给出正面替代

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/skill-optimization.md (reported line 745)May include surrounding context.

md

# ✅ AFTER: SKILL.md 只保留核心 + 引用
## API Usage
Base URL: `https://api.example.com/v2`
Auth: Bearer token in `Authorization` header

For endpoint details, read the relevant reference:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/skill-taxonomy.md (reported line 202)May include surrounding context.

[Document completeness checklist]

text

- **Key Elements**: Fixed output structure; per-section content requirements; format specification (Markdown, Mermaid, tables); completeness verification checklist.
- **Common Pitfalls**: Unfixed output structure (format inconsistency); no verification step (documents may be incomplete).
- **Examples**: repowiki, project-docs-generator

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes natural-language guidance that a skill may use an "Always" trigger mode and be loaded every conversation. Without explicit exclusion conditions or narrow context limits, this activation model is overly broad and matches the vague-trigger criteria for markdown files.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/quick_validate.py (reported line 160)May include surrounding context.

python

verification_keywords = r"verify|check|validate|confirm|确保|验证"
    if not re.search(verification_keywords, content, re.IGNORECASE):
        warnings.append(
            "D7: No verification keywords found — consider adding verification steps"
        )

    # --- D9: Progressive loading ---

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script hard-codes Chinese terms in its example and verification keyword heuristics (示例, 确保, 验证) alongside English, which reflects a locale/language assumption in natural-language guidance. There is no surrounding comment or documentation explaining that the skill is intentionally bilingual or region-specific, nor any user opt-in for this language choice.

Content

No source excerpt is available for this finding.