Security audit

Daozheji Grill Skill

Security checks for vulnerabilities and agentic risk

Overview

This restaurant customer-service skill is mostly coherent, but its installers add unattended daily updates from a mutable GitHub branch and recommend direct remote script execution.

Review the installer before using this skill. Avoid the one-line remote execution commands, and do not install the default auto-update cron job or Windows Scheduled Task unless you accept unattended future changes from the GitHub repository. Prefer a pinned release or reviewed local copy, and remove any existing daily update task if already installed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:5
Finding: Remote Unix Installer Is Executed Directly from a Mutable Branch
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.ps1:4
Finding: Remote PowerShell Installer Is Executed Directly Through Invoke-Expression
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: install.sh:47
Finding: Unix Installer Creates a Persistent Daily Unverified Update Job
Content: View full analysis
/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - echo "自动更新已配置（每天 3:07）" fi ``` ### Technical Analysis The installer automatically modifies the user's crontab and installs a job that runs every day at 03:07. The job performs `git pull` from mutable `main` or `master` branches without pinning a commit, verifying a signature, checking a release checksum, or requesting approval for each update. The persistence is installed by default rather than as a clearly separated opt-in feature. The README describes the customer-service Skill but does not disclose this scheduled side effect. Scheduled automatic updates are not required for answering restaurant questions and therefore exceed the minimum privileges and lifecycle needed by the Skill. Because the repository includes `SKILL.md`, scripts, and reference data, a later upstream change can alter Agent behavior after the originally reviewed version has been installed. ### Attack Path 1. The user runs the installer once. 2. The installer adds a persistent entry to the user's crontab. 3. The initial repository version may remain benign during installation and review. 4. An attacker later compromises the repository or gains permission to modify its default branch. 5. At 03:07, cron performs an unattended `git pull`. 6. The attacker's changes are copied into the installed Skill. 7. Modified Skill instructions affect later Agent sessions, or modified local scripts become available for execution. ### Impact Assessment The scheduled job persists across shell sessions and sys ...[truncated 637 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: install.ps1:41
Finding: Windows Installer Creates a Persistent Daily Unverified Update Task
Content: View full analysis
`$null; if (`$LASTEXITCODE -ne 0) { git pull --ff-only origin master 2>`$null }`"" -WorkingDirectory $SkillPath $Trigger = New-ScheduledTaskTrigger -Daily -At 03:07 Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Description "稻哲纪烤羊排Skill自动更新" | Out-Null Write-Host "自动更新已配置（每天 3:07）" -ForegroundColor Green } ``` ### Technical Analysis The Windows installer registers a persistent Scheduled Task that launches PowerShell every day and pulls changes from mutable Git branches. Updates are applied without user confirmation, release pinning, checksum validation, commit-signature enforcement, or publisher verification. This task survives the installation process and future PowerShell sessions. It creates a persistent upstream trust channel unrelated to the minimum functionality required by a restaurant-information Skill. ### Attack Path 1. A user executes the Windows installer. 2. The installer registers `DaozhejiGrillSkillUpdate`. 3. The task remains registered after the installer exits. 4. An attacker later modifies the upstream `main` or `master` branch. 5. The task launches PowerShell at 03:07. 6. `git pull` imports the attacker-controlled changes without user review. 7. Altered Skill instructions, data, or scripts become part of the local installation. ### Impact Assessment The Scheduled Task runs with the task owner's security context and persists across sessions. It provides a continuing path for remote repository ch ...[truncated 513 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: install.sh:13
Finding: Environment-Controlled Unix Installation Path Is Embedded in a Persistent Shell Command
Content: View full analysis
/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - fi ``` ### Technical Analysis `SKILLS_DIR` is accepted from the environment and used to construct `SKILL_PATH`. That path is then interpolated into a shell command without shell-safe quoting and stored in the user's crontab. A path containing shell metacharacters, command substitutions, or newline characters can alter the meaning of the generated cron command. Quoting filesystem operations elsewhere in the installer does not protect this separately constructed command string. Exploitation requires influence over the environment used to launch the installer, such as a malicious wrapper command, compromised parent process, manipulated automation environment, or deceptive installation instructions. ### Attack Path 1. An attacker causes the victim to run the installer with a crafted `SKILLS_DIR` value. 2. The value includes shell syntax that changes the generated `UPDATE_CMD`. 3. The installer interpolates the value without safe shell escaping. 4. The resulting command is written into the user's crontab. 5. Cron parses the injected syntax when the job runs. 6. The injected command executes with the cron owner's privileges. ### Impact Assessment Successful exploitation can produce persistent arbitrary command execution as the installing user. The attacker could access all files, credentials, and processes available to that account. The vulnerability does not inherently ...[truncated 145 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: install.ps1:10
Finding: Environment-Controlled Windows Installation Path Is Embedded in Scheduled PowerShell Source
Content: View full analysis
`$null; if (`$LASTEXITCODE -ne 0) { git pull --ff-only origin master 2>`$null }`"" -WorkingDirectory $SkillPath $Trigger = New-ScheduledTaskTrigger -Daily -At 03:07 Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Description "稻哲纪烤羊排Skill自动更新" | Out-Null ``` ### Technical Analysis The installer trusts the environment variable `SKILLS_DIR`, constructs `$SkillPath`, and places that path inside single-quoted PowerShell source passed through `-c`. No escaping is applied for embedded single quotes or other PowerShell syntax. A crafted environment value can terminate the quoted path and append PowerShell statements to the persistent task action. Exploitation requires control or influence over the environment from which the installer is launched. ### Attack Path 1. The attacker supplies or induces a crafted `SKILLS_DIR` environment value. 2. The victim runs the installer. 3. `$SkillPath` contains attacker-controlled PowerShell syntax. 4. The value is embedded into the `-Argument` command source without escaping. 5. The installer registers the malformed command as a Scheduled Task action. 6. When the task runs, PowerShell interprets the injected statements. 7. The injected code executes as the Scheduled Task account. ### Impact Assessment Successful exploitation enables persistent arbitrary PowerShell execution with the task owner's privileges. This can expose user files, credentials, Agent configurati ...[truncated 186 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (26)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using curl ... | bash directly executes whatever content is returned by the remote server, turning any repository compromise, account takeover, DNS/TLS interception edge case, or content swap into immediate code execution. In this skill context, it is more dangerous because the same installer also establishes persistence via cron, so a single blind execution can lead to ongoing unattended updates.
Content: Scanner excerpt · install.sh (reported line 6)May include surrounding context.
sh
# 稻哲纪烤羊排 Skill · 一键安装脚本 # ============================================================ # 用法（客户只需运行这一行）： # curl -sSL https://raw.githubusercontent.com/Liubuq-sys/daozheji-grill-skill/main/install.sh | bash # ============================================================ set -e

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes very broad everyday food terms such as '羊排' and '烧烤', which can cause the skill to activate in unrelated conversations about food rather than this specific restaurant. In an agent setting, overbroad invocation can lead to unintended takeover of responses, user confusion, and misrouting of requests, even though the content itself is not overtly harmful.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description includes broad generic terms such as dish names and category words that are not unique to this restaurant, making unintended activation likely. That can cause the skill to answer as the restaurant in unrelated conversations, producing misleading business information and weakening routing integrity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states that concrete business facts must be read from reference files in real time, yet the dialogue examples hardcode specific claims about lamb origin, egg-batter process, and cooking duration directly in the skill. This creates an instruction conflict that can cause the agent to repeat unverifiable or stale facts, undermining accuracy and potentially creating food-safety or false-advertising issues.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This section elevates references/faq.md as the authoritative source for food-safety, allergen, ingredient, and process answers, but the scenarios still embed detailed sourcing and preparation claims inline. In a restaurant-support context, conflicting food/process guidance is more dangerous because users may rely on it for allergy, dietary, or safety decisions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The short-keyword table relies on ambiguous one-word triggers like '菜单', '价', '送', and '会员' without context checks, which can easily match unrelated user requests. In this skill, accidental triggering is especially risky because it may prompt confident, business-specific responses drawn from restaurant files even when the user meant something else.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script forcefully deletes the existing skill directory before replacement, without confirmation, backup, or validation that the path only contains expected files. If the directory contains user changes or unexpected content, data can be lost immediately and irreversibly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The installer creates a persistent scheduled task that will continue executing after the one-time install completes, giving the repository ongoing ability to change code on the host. This expands the trust boundary from a single installation event to indefinite remote updates, and the behavior is not clearly surfaced as a separate opt-in step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The installer silently registers a persistent scheduled task for daily execution without prior user disclosure or consent. Hidden persistence is risky because it normalizes unattended code execution and can later deliver modified repository contents onto the machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script deletes an existing target directory with rm -rf when it is not a git checkout, without prompting the user or creating a backup. This can destroy local modifications or unrelated data if the path contains unexpected contents.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The installer advertises simple install/update behavior but also silently establishes a persistent daily cron job. Undisclosed persistence changes the user's system state beyond a one-time install and can later pull and execute repository changes without renewed user review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The installer creates a persistent cron job without obtaining prior user consent. Persistent scheduled updates expand the attack surface because future repository changes will be fetched automatically, and the user may not realize ongoing background modifications are occurring.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 98% confidence
Finding: Reading and modifying the user's crontab to add a daily task is a form of persistence. In the context of an installer, this is risky because it causes recurring execution tied to remote repository state, enabling silent future changes to be introduced onto the host.
Content: Scanner excerpt · install.sh (reported line 49)May include surrounding context.
sh
# 配置自动更新（追加到 crontab，不重复添加） UPDATE_CMD="cd $SKILL_PATH && git pull --ff-only origin main 2>/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - echo "自动更新已配置（每天 3:07）" fi

Session Persistence

Medium

Category: Rogue Agent
Confidence: 99% confidence
Finding: This line writes a new cron entry that will execute indefinitely on a daily schedule, creating durable persistence on the system. Because the command performs git pull from a remote repository, any later compromise of that repository or branch could propagate automatically to the user's environment.
Content: Scanner excerpt · install.sh (reported line 50)May include surrounding context.
sh
# 配置自动更新（追加到 crontab，不重复添加） UPDATE_CMD="cd $SKILL_PATH && git pull --ff-only origin main 2>/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - echo "自动更新已配置（每天 3:07）" fi

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The installation output instructs the user to trigger the skill using a fixed Chinese phrase only, and the rest of the script messaging is also exclusively in Chinese. This imposes a language requirement without user opt-in or any stated locale limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document publicly includes a Wi‑Fi password, which is an access credential and should not be broadly exposed in a reference file. Even though this appears to be a restaurant guest network, publishing the password in skill content can enable unauthorized access, password reuse abuse, and wider uncontrolled distribution beyond intended customers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The FAQ states that children can 'completely' eat the dishes and tells caregivers to 'rest assured' even though the same document later discloses allergens such as egg, sesame, soy, and spicy ingredients. This can mislead staff or customers into treating the food as universally safe for children, increasing the risk of allergic reactions or age-inappropriate consumption.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains user-facing natural language only in Chinese, which can constitute a language/locale policy issue when no opt-in, alternative language, or justification is provided. The file does not indicate that the skill is region-specific or that Chinese is an intentional, documented locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: 对话风格要求 AI 一律使用“热情熟络”的中文表达，并明确使用“咱家”“哥/姐”这类称呼，但文档未说明可根据用户语言偏好或正式程度进行调整。这种固定语言/语气要求可能与用户的语言或沟通偏好不一致，构成自然语言政策层面的可选择性不足。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The final instruction tells users to trigger the skill with a single Chinese phrase, implying a fixed-language activation model. There is no indication that other languages are supported, optional, or intentionally restricted for a documented regional reason.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The installer recommends fetching a script directly from the network and executing it immediately. This removes the user's opportunity to inspect the code and makes them dependent on transport integrity and the security of the hosting account and repository at execution time.
Content: Scanner excerpt · install.sh (reported line 6)May include surrounding context.
sh
# 稻哲纪烤羊排 Skill · 一键安装脚本 # ============================================================ # 用法（客户只需运行这一行）： # curl -sSL https://raw.githubusercontent.com/Liubuq-sys/daozheji-grill-skill/main/install.sh | bash # ============================================================ set -e

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing skill content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The FAQ says pets are allowed without qualification, but pet access may be restricted by local health regulations, service-animal rules, or venue-specific hygiene policies. An unconditional statement could cause customer disputes, noncompliance, or unsafe expectations if animals are later refused or allowed inappropriately around food service areas.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file is entirely written in Chinese and does not indicate that the user can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file consists solely of Chinese-language content and does not indicate that the skill is region-specific or that users may choose another language. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.