T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imgread.py:7- Finding
Unrestricted local file upload to a third-party image-processing service
- Content
View full analysis
- Remediation
View remediation
Security audit
试验图片数据提取
Security checks for vulnerabilities and agentic risk
Overview
The skill performs image table extraction, but it can upload selected files to a third-party service and asks for an API key without enough safeguards or disclosure.
Review this skill before installing. Only use it with images you are willing to send to the Ketop third-party service, do not paste long-lived or privileged API keys into chat, and avoid pointing the script at arbitrary local paths. Prefer a version that asks for explicit upload consent, restricts files to the uploaded image, validates image type and size, and uses a secure secret store.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:35- Finding
Spreadsheet formula injection through unchanged CSV export
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and generic, which can cause the skill to activate in contexts where the user did not clearly intend to invoke this workflow. Over-broad activation increases the chance of misrouting user requests or causing unintended processing of uploaded images and extracted data, especially in systems with multiple overlapping skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire skill metadata and operating instructions are written only in Chinese, and no language choice or opt-in is offered to the user. This can amount to an implicit language constraint without documented justification or user selection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation condition states that the skill should run whenever a user needs table extraction, recognition, or export, but it does not define boundaries or exclusions. In a multi-skill environment, such loose conditions can lead to incorrect invocation, unexpected handling of sensitive images, and user confusion about why data extraction occurred.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to request, handle, and place a user-provided access key into an environment variable without any safeguards for secret handling. This is dangerous because secrets may be exposed in chat history, logs, shell history, process listings, or error output, especially in an agent environment that may persist or reuse context.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions explicitly tell the agent to solicit, save, and continue using a user-provided access key during execution, which creates a clear secret-retention risk. In a skill context, this is more dangerous because the agent may preserve state across steps, expose secrets to tools/subprocesses, or accidentally disclose the token in outputs and diagnostics, enabling unauthorized access to the external service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file states that all data should keep its original format and values unchanged, but the next section instructs removing cells whose content is "pass" or "通过". This means the documented behavior is not purely extraction/output as described in the manifest; it alters extracted data before output.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions say to keep all data in original format without modifying any value, then immediately direct the skill to remove cells containing specific values. Later notes repeat both "不修改数据" and the filtering rule, creating an active contradiction in the skill's documented intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code uploads the user-supplied image to a hard-coded third-party API endpoint for processing. For a skill described as extracting table data from images, this creates a real data-exfiltration and privacy risk because image contents may include sensitive business or personal information, and the behavior is not made explicit in the code path shown.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function sends raw image contents to an external API without any visible user-facing warning, consent, or indication that processing is remote. This is dangerous because users may reasonably expect local extraction from the skill description, and sensitive image data could be transferred off-system unexpectedly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains a natural-language requirement that all CSV data 'must' use UTF-8 encoding. Under the policy, forcing a specific language/locale-related setting without opt-in or justification can be a policy violation, and no rationale or alternative is provided here.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The skill's stated purpose is image table extraction and CSV-style output, but the code additionally depends on a secret token sourced from the runtime environment. Accessing environment-held credentials is not part of the user-visible purpose and implies hidden external service integration.
- Content