Programming

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:58 AM UTC
• Version: 1.0.0

Overview

This skill mainly displays programming guidance and does not itself modify files or transmit data, but users should be careful with its Claude CLI examples.

Install only if you are comfortable with a Chinese-language programming guide. Before following the Claude CLI examples, verify the package source, avoid sending secrets or proprietary files without authorization, and review generated code before writing it into a project.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: claude_cli_guide.md:11
• Finding: Unpinned and Insufficiently Verified Third-Party CLI Installation## Vulnerability Details **File Location**: `claude_cli_guide.md`, line 11 **Vulnerability Type**: Unverified third-party dependency installation **Risk Level**: Medium ```bash brew install anthropic ``` ### Technical Analysis The guide instructs users to install a third-party package without specifying a trusted repository, an approved package identity, a fixed or constrained version, or checksum and signature verification. Consequently, the package resolved at installation time may differ from the component originally reviewed. Package-manager installation can execute downloaded binaries and package lifecycle operations with the invoking user's privileges. If the package source, formula, maintainer account, or distribution infrastructure is compromised, following this instruction could introduce attacker-controlled code into the local environment. ### Attack Path 1. An attacker compromises or substitutes the package, its formula, a maintainer account, or an associated distribution artifact. 2. A user follows the installation command from the guide. 3. Homebrew resolves and installs the attacker-controlled or modified package. 4. Malicious installation logic or the installed executable runs with the user's privileges. 5. The package accesses source code, environment variables, credentials, or other files available to that user. ### Impact Assessment Successful exploitation can provide code execution under the privileges of the user performing the installation. The accessible scope may include the user's source repositories, shell environment, API credentials, SSH configuration, and other user-readable files. This instruction does not itself obtain elevated administrative privileges; the ultimate scope depends on the privileges granted during installation and subsequent execution.
• Remediation: ## Remediation Suggestions - Identify the exact vendor-approved package and official repository. - Pin or constrain the package to a reviewed version instead of resolving an unrestricted latest release. - Document checksum or cryptographic-signature verification where supported. - Verify the package publisher and formula source before installation. - Avoid ambiguous instructions that permit installation through unspecified alternative channels. - Recommend installation in a restricted environment without unnecessary credentials or access to sensitive repositories. - Establish a documented update and re-review process before changing the approved version.

T09 · Insecure Skill Coding Practices

Warning

• Location: claude_cli_guide.md:27
• Finding: Potential Disclosure of Local Source Code to an External AI Service## Vulnerability Details **File Location**: `claude_cli_guide.md`, lines 27-33 **Vulnerability Type**: Uncontrolled transmission of local file contents **Risk Level**: Medium ```bash cat main.py | claude-cli ``` The documented command pipes the contents of `main.py` into an external AI CLI. The surrounding guide also recommends sending files for analysis and saving generated output locally. ### Technical Analysis The workflow deliberately transfers local source-file contents across a trust boundary, but it does not require data classification, secret scanning, redaction, file allowlisting, destination verification, or explicit user approval. Source files can contain hardcoded credentials, private endpoints, customer information, proprietary algorithms, internal comments, or regulated data. The risk increases when the documented pattern is generalized to multiple files or automated across a repository. A broad automated submission may include configuration files, private keys, environment files, generated artifacts, or files that the user did not intend to disclose. ### Attack Path 1. A local project file contains proprietary code, credentials, personal data, or confidential configuration. 2. A user follows the documented pipeline or adapts it to process multiple project files. 3. The CLI receives the complete file contents through standard input. 4. The CLI transmits those contents to its configured external service. 5. Sensitive data leaves the local trust boundary and may be processed, logged, or retained according to the external provider's configuration and policies. ### Impact Assessment Exploitation does not directly grant local operating-system privileges. Its primary impact is confidentiality loss affecting any information included in submitted files. The scope can range from one source file to an entire repository when the workflow is automated. Disclosed credentials may enable secondary access to source-cont ...[truncated 116 chars]
• Remediation: ## Remediation Suggestions - Require explicit, informed user confirmation before transmitting any file to an external service. - Clearly identify the transmission destination and applicable logging, retention, training, and deletion policies. - Run secret detection and data-classification checks before submission. - Redact credentials, tokens, private keys, personal data, internal endpoints, and other sensitive values. - Use an explicit file allowlist rather than recursively submitting repositories. - Deny sensitive patterns and paths by default, including `.env` files, credential stores, private keys, deployment secrets, and production configuration. - Prefer an organization-approved enterprise endpoint or a local model when handling confidential code. - Display the exact files and estimated transmitted content to the user before execution. - Ensure automation fails closed when secret scanning or destination verification cannot be completed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire skill description is written in Chinese and does not indicate that users may interact in other languages or select a preferred locale. Under the language/locale policy rule, this can constitute a natural-language policy violation because it implicitly constrains usage to a specific language without opt-in or justification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide explicitly shows piping local file contents to Claude for analysis without any warning about sensitive data exposure, consent, or data-handling implications. In a developer-facing skill, this can normalize sending source code, secrets, proprietary logic, or personal data to an external AI service, creating confidentiality and compliance risks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document shows sending model output directly into a file and later encourages large-scale code modification workflows, but it does not instruct users to review generated content before saving or applying it. This can lead to unsafe overwrites, insertion of insecure code, or propagation of hallucinated or malicious changes into a project.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown skill forces a specific language for all guidance and checklist items, which can violate language or locale policy when no user opt-in or justification is provided. The file contains no indication that the skill is region-specific or that users may choose another language.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This shell skill uses Chinese exclusively in comments, usage text, and operational messages, which constitutes a language/locale restriction in natural language. There is no indication that the skill is region-specific or that users can opt into a different language, so it may violate organizational language-choice policy.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The skill content appears to force a specific language for all instructions and examples. Under the stated policy, a language-specific presentation should either offer user choice or clearly document why the locale restriction is necessary.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The manifest descriptions for the skill and its methods are all written exclusively in Chinese, which can impose a language-specific experience without any documented opt-in or alternative locale. Under the policy for natural-language violations, language constraints should either be optional or clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The skill file is entirely written in Chinese and begins with a Chinese-only title, with no indication that users may choose another language or that the skill is intended for a Chinese-only audience. This can conflict with language/locale policy requirements that prohibit forcing a specific language without user opt-in.

Static analysis

No suspicious patterns detected.