T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:175- Finding
Unverified Remote Skill Download and Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
linkfox-skill-creator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent skill-creation assistant, but it includes under-scoped mechanisms for installing remote skills and generating helpers that execute local Python scripts by path.
Install only if you trust the Linkfox ecosystem and are comfortable with it creating persistent local skill files, generated Python scripts, evaluator reports, and possibly installing an onboarding skill from a remote URL. Review or harden api_call.py before using generated skills that call linkfox-* tools, and avoid running generated workflows with sensitive environment variables unless target scripts and output paths are verified.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
templates/api_call.py:66- Finding
Unrestricted Python Script Execution and Arbitrary Writable Output Path
- Content
View full analysis
- Remediation
View remediation
/scripts/ ``` 4. Use `Path.is_relative_to()` or an equivalent canonical-path containment check after resolution. 5. Reject symlinked targets, or securely verify both the link and final target. 6. Require the script filename and SHA-256 digest to match a reviewed dependency manifest. 7. Constrain output to a dedicated root owned by the generated Skill, such as `/data/`. 8. Reject absolute output paths and any path that resolves outside the data root. 9. Reject symlinked output files and symlinked parent directories. 10. Avoid silently replacing files: - Use exclusive creation when a new result is expected. - Generate unique result names. - Require explicit approval before overwriting an existing file. 11. Apply a subprocess timeout and terminate stalled child processes. 12. Set maximum stdout and stderr sizes to prevent memory exhaustion. 13. Pass a minimal environment to the subprocess instead of inheriting all environment variables. 14. Validate the expected output schema rather than accepting arbitrary JSON or raw text. 15. Remove the rule requiring the wrapper to be copied unchanged; generated Skills should receive the hardened implementation. 16. Add security tests covering: - Targets outside the dependency directory. - Symlink-based target escapes. - Absolute and traversal-based output paths. - Symlink-based output overwrite. - Existing-file replacement. - Excessive output. - Child-process timeout. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as an interview-based skill creation wizard, but its documented behavior includes executing arbitrary Python scripts, writing outputs to arbitrary paths, and acting as a wrapper for delegated tooling. That mismatch is dangerous because users may authorize a benign-seeming assistant while it performs materially more privileged operations than advertised, undermining informed consent and security review.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document instructs generated artifacts to discover and invoke scripts from
~/.claude/skills/<slug>/scripts/..., effectively coupling behavior to private local installation paths and enabling execution of locally installed code outside the normal abstraction boundary. In a skill-creation wizard, this is dangerous because it grants a generated skill knowledge of and operational dependence on host-local internals that may vary, be tampered with, or expose sensitive data and capabilities.- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The contradictory rules around whether delegate steps should be nested skill calls or generated-script execution weaken enforcement and make it more likely that implementers will choose the more permissive path. In this file’s context, that ambiguity is dangerous because the permissive path is exactly the one that bypasses normal delegation boundaries and executes local underlying scripts directly.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The subprocess call provides arbitrary execution capability that is not justified by the stated business purpose and can be abused to run any local Python script by path. In a skill ecosystem, this is especially dangerous because it creates a reusable execution trampoline that can invoke other skills' scripts, exfiltrate data through outputs, or perform unauthorized actions while hiding raw results from the host context.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to generate local files, copy scripts, invoke shell/Python execution paths, and potentially download/install additional skills, but it declares no explicit tool scope or permission boundaries. This creates an authorization gap where powerful capabilities may be used implicitly without clear user consent or platform enforcement, increasing the risk of unintended file modification or command execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该 markdown 文件的描述列出了“帮我写一个 XX skill / 创建新技能 / create a new skill”等触发话术，其中“创建新技能”和英文短语缺少上下文限定，容易与一般性的日常求助或产品内其他创建意图重叠。描述中也未提供负例或排除条件来界定何时不应触发该技能，因此存在触发范围过宽的问题。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
文档要求“全程业务语言”，并明确禁止在与用户对话中出现一系列技术术语，这构成了对交互语言/表达方式的强制限制。文件中未见允许用户选择更技术化表述、其他语言或术语透明模式的选项，因此存在未经用户选择即强制特定语言风格的政策风险。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill describes generating files locally, copying executable scripts, and downloading/installing an external skill, yet it lacks a centralized, explicit risk disclosure and consent flow. Users may not realize that local state will be modified or that external content may be introduced, which increases the chance of unsafe approval and unintended system changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill contains instructions to download and install another skill package from an external URL, which expands trust to remote content outside the declared workflow. This introduces supply-chain risk: a compromised package, replaced archive, or socially engineered approval could lead to execution of unreviewed code or persistence of unsafe capabilities.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document is entirely written as prescriptive interaction guidance in Chinese and includes fixed Chinese user-facing scripts, such as the required opening phrasing and confirmation prompts. This effectively forces a specific language/locale for the skill workflow without any opt-in or alternative language path, which matches the policy-violation category for language constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The entire instruction set is written as mandatory Chinese-language guidance and includes examples, prompts, and required output phrasing only in Chinese. There is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific context, which creates a locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file consists entirely of Chinese-language instructions and embedded user-facing scripts, but it does not state that the skill is region-specific or that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该 markdown 文件明确要求在 description 中加入多条“自然语言触发词”，来源还是 typical_trigger_moment 和专家原话片段，但没有要求这些触发词足够具体，也没有要求提供负例或不触发条件。这会增加技能被日常表达误触发的风险，符合对模糊触发条件的判定。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The earlier rule states that delegate steps do not generate scripts and should be handled by downstream skill invocation. Later sections require creating scripts/api_call.py specifically for certain delegate cases, which is an active contradiction in the file's own guidance about what delegate handling entails.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
这里要求脚本顶部使用“中文 docstring”，属于明确的语言/locale 约束，但文档中未说明这是用户可选项，也未给出仅适用于中文环境的正当限制。根据规则，这构成自然语言层面的语言政策问题。
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This guidance tells generated skills to bypass normal skill delegation and directly execute another installed skill’s underlying script via
api_call.py, while persisting raw JSON outputs to disk. That expands the created skill’s authority from interview-to-skill transformation into local code execution and data handling against private implementation paths, increasing the risk of unsafe chaining, unintended data exposure, and abuse of any delegated tool’s credentials or side effects.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
These lines prescribe network-capable scripts with credential handling for external services. While some generated downstream skills may need that, the creator skill's stated purpose is expert-knowledge capture and skill synthesis, not enabling arbitrary API integrations as part of its own operational scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The handoff instructions prescribe specific Chinese phrasing and require how the agent should speak, but they do not offer the user a language or locale choice. This is a natural-language policy concern because it enforces a language style by default rather than documenting opt-in or a justified locale restriction.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The recommended evaluator trigger phrases are broad natural-language requests such as '评估一下 ... 这个 skill' and '做一次完整评估', which can overlap with ordinary user conversation about evaluating a skill. In an agent environment that auto-routes based on fuzzy matching, this increases the chance of accidental evaluator invocation, causing unintended side effects such as report generation, extra tool usage, or workflow transitions without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The tryout guidance tells the expert to trigger the skill with a generic phrase like '帮我查侵权：<链接>', which may be indistinguishable from a normal operational request. If the agent's skill activation is broad, ordinary user tasks could unintentionally force this skill path, bypassing clearer routing or user choice and producing actions under the wrong workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill instruction set is written to conduct the workflow and expert-facing prompts in Chinese, including prescribed quoted dialogue such as '用下面格式读给专家'. There is no indication that language choice is optional or limited to a justified region-specific context, so the file effectively imposes a specific language/locale without opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The delegate discovery trigger matches very broad verb-object combinations like '查/找/分析' with common ecommerce nouns, which can cause delegate search to activate for many ordinary process descriptions. In this skill-creation context, that can misclassify steps as needing external delegation, leading to unintended tool discovery, workflow confusion, or accidental invocation of capabilities the expert did not intend to use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file is written entirely in Chinese and includes mandatory procedural instructions for any agent reading the skill, but nowhere indicates that language choice is optional or that the Chinese-only requirement is justified by a region-specific need. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill specification is written as a hard Chinese-language instruction set, including required prompts and report text, with no indication that users may choose another language or that the evaluator is restricted to a Chinese-only context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill specification is written in Chinese and instructs prompts and outputs in Chinese, with no indication that users or downstream agents may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the constraint is explicitly justified.
- Content