T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.py:34- Finding
Path Traversal Allows Analysis Outside the Intended KPI Data Directories
- Content
View full analysis
- Remediation
View remediation
Security audit
Boot Kpi Analyzer
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly performs local vehicle KPI log analysis, but it needs Review because its script can read outside the intended KPI folders and prints VIN identifiers by default.
Install only in the intended internal KPI environment. Avoid running it on untrusted session names, do not pass arbitrary paths to --dir, and treat output as potentially sensitive because it may include VINs, build IDs, boot counters, error messages, and raw log summaries.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/analyze.py:327- Finding
Vehicle Identification Number Is Disclosed in Default Command Output
- Content
View full analysis
{r.get('boot_counts_after', '?')}") print(f" has_lastlog : {r.get('has_lastlog', False)}") ``` ### Technical Analysis The shutdown analysis reads the `vin` field from `report.json` and prints it by default. A vehicle identification number is a persistent identifier for a specific vehicle and is not required to calculate reboot duration, shutdown timing, service duration, or other documented KPI measurements. The Skill documentation identifies relevant report fields such as `reboot_duration`, `test_result`, `build_id`, `has_lastlog`, and `error_message`, but it does not disclose that VIN data will be emitted. Consequently, users may invoke the analysis without expecting a vehicle identifier to enter terminal logs, Agent transcripts, CI output, or other retained records. The code does not itself transmit the VIN over a network. The risk arises from unnecessary inclusion in standard output and any downstream retention or sharing of that output. ### Attack Path 1. A shutdown session contains a `report.json` file with a populated `vin` field. 2. A user or Agent runs: ```bash python3 scripts/analyze.py shutdown --latest ``` or selects a specific session with `--dir`. 3. The script loads the report and extracts the VIN. 4. The complete identifier is printed to standard output without masking or explicit user consent. 5. Th ...[truncated 579 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This markdown skill file presents all functional instructions and operational guidance in Chinese only. Per the policy, forcing a specific language without offering the user a choice is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script prints fields from report.json directly to stdout, including VIN, build ID, boot counters, and error details, without masking, consent, or any warning that sensitive device/session data will be exposed. In shared terminals, CI logs, shell history capture, or support bundles, this can leak identifiable vehicle information and operational metadata to unauthorized viewers.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module docstring and CLI help text are presented in Chinese without indicating that language is configurable or user-selectable. This can violate a language/locale policy when a skill effectively forces one language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The argparse description, examples, and subcommand help strings are all hardcoded in Chinese, which constrains user interaction to one locale. No alternative locale, opt-in, or justification for the language restriction is documented in the file.
- Content