AI编码异常处理控制框架

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 1.7.0

Overview

This is a coding-quality skill with a coherent purpose, but it broadly auto-activates and directs persistent memory, skill/SOP changes, mandatory web research, and unsafe chaos-test actions without enough user control.

Review before installing. Use this only if you want a heavyweight Chinese-language coding workflow, and disable or modify the parts that auto-trigger on generic coding requests, write persistent lessons, modify SKILL.md/SOP files, mandate web searches, log raw request data, or run chaos tests against real containers or external services.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: references/lessons-feedback-loop.md:265

Finding

Persistent Memory Injection and Self-Modification of Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: references/lessons-feedback-loop.md:265-296; related instructions also appear at SKILL.md:352-360, SKILL.md:376, references/coding-sop.md:104, and references/coding-sop.md:251-256
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: Critical

Vulnerable Code Snippet

The following is a faithful English translation of the operational instructions in the cited source section:

text

Before beginning coding, perform the following preventive checks:

1. Read lessons-learned.md and review the latest 10 detours.
2. Identify similar detours that may occur in the current feature.
3. Confirm that preventive measures for each applicable detour are present
   in the current process.
4. If preventive measures have not taken effect, proactively warn and add them.

Project-level detours:
    .workbuddy/memory/lessons-learned.md

Cross-project general detours:
    After refinement, append them to the "Lessons Learned" section of
    ai-coding-exception-control/SKILL.md.

Lifecycle:
    Create on the first detour
    -> continually append new detours
    -> periodically analyze
    -> update the Skill or SOP
    -> validate effectiveness
    -> archive general lessons in SKILL.md

The corresponding primary Skill instructions require records to be appended to persistent state and later promoted into the Skill:

text

Project level:
    .workbuddy/memory/lessons-learned.md
    Append only; do not modify previous records.

Cross-project:
    Refine and append the lesson to the "Lessons Learned" section of this file.

Every feature task:
    Record coding and debugging detours in lessons-learned.md,
    then periodically analyze them and improve the Skill or SOP.

Technical Analysis

This design creates a persistent instruction-injection chain:

1. Information derived from a task, repository, error message, gene ...[truncated 2721 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic writes to global or cross-session Agent memory.
2. Never modify SKILL.md or SOP files during ordinary Skill execution.
3. Store lessons as inert records that are never interpreted as instructions.
4. Require explicit user review and confirmation before promoting any lesson into a rule.
5. Record immutable provenance, including source file, originating task, author, timestamp, and content hash.
6. Reject or quarantine entries containing instruction-like phrases, tool directives, privilege requests, external URLs, or attempts to override existing rules.
7. Scope memory to the current repository instead of a shared global location.
8. Exclude the memory directory from version control by default.
9. Add expiration, deletion, rollback, and quarantine mechanisms.
10. Present proposed Skill changes as a patch for human approval rather than applying them automatically.
11. Ensure user, repository, web, and tool-output content can never directly become trusted Skill instructions.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:237

Finding

Mandatory Logging of Request Parameters and User Identifiers Can Expose Secrets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:237-241
Vulnerability Type: Sensitive information exposure through application logs
Risk Level: High

Vulnerable Code Snippet

The following is a faithful English translation of the complete affected instruction block:

text

Constraints:
- Empty catch blocks are prohibited.
- Catch blocks containing only console.log are prohibited.
- Every catch block must have an explicit recovery strategy or propagate upward.
- Exception logs must contain context: request parameters, user ID, and timestamp.
- User-facing error messages must be friendly and must not expose technical details.

Technical Analysis

The Skill mandates logging request parameters and user IDs without requiring an allowlist, sensitivity classification, or redaction step. Request parameters routinely include:

• Passwords and one-time authentication codes.
• Access tokens, refresh tokens, and API keys.
• Session identifiers and cookies.
• Personal data such as phone numbers and email addresses.
• Financial or health-related fields.
• Internal object identifiers and tenant information.

Exception paths are particularly likely to contain raw input because logging commonly occurs before validation or normalization completes. Structured logging can also serialize nested request objects, headers, or authorization fields unless explicitly filtered.

The repository contains separate redaction guidance for audit reports, but that protection is not connected to this runtime logging mandate. Preventing technical details from reaching the end user does not prevent the same details from being exposed in logs.

Attack Path

1. A request contains a password, token, authorization code, personal record, or other sensitive field.
2. An attacker intentionally submits malformed input or triggers an exception.
3. Code generated under this Skill follows the requirement to log request param ...[truncated 909 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace full request-parameter logging with an explicit field allowlist.
2. Prohibit logging passwords, authentication codes, tokens, cookies, authorization headers, private keys, connection strings, and personal data.
3. Apply recursive structured redaction before objects are serialized.
4. Log parameter names, validation outcomes, and bounded metadata instead of raw values.
5. Prefer opaque request or trace IDs over raw user identifiers.
6. Hash identifiers only when correlation is necessary and the hash cannot be reversed through a small input space.
7. Add automated tests verifying that sensitive fields never appear in log output.
8. Configure restricted access, encryption, retention limits, and deletion policies for logs.
9. Document that redaction must occur before data is passed to any local or remote logging transport.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/requirements-design-sop.md:43

Finding

Mandatory Web Research Can Disclose Confidential Task and Repository Context

Content

View full analysis

Vulnerability Details

File Location: references/requirements-design-sop.md:43-55; repeated at SKILL.md:79, references/coding-sop.md:35, and references/requirements-design-sop.md:972-1007
Vulnerability Type: Unnecessary external transmission of task-derived information
Risk Level: Medium

Vulnerable Code Snippet

The following is a faithful English translation of the affected instructions:

text

Execution method:

The Agent must proactively use WebSearch and WebFetch for online research,
and use Grep, Glob, and Agent for repository research.
It is prohibited to fabricate best practices using only training data.

Research method:
- WebSearch "[feature keyword] product case"
- WebSearch "[feature keyword] product comparison"

Later mandatory checks repeat the same requirement:

text

During research, WebSearch and WebFetch must be used for online research,
while Grep, Glob, and Agent must be used for repository research.

Every research direction must contain an actual WebSearch or WebFetch record.

Technical Analysis

Online research may be useful for current documentation or compatibility questions, but this Skill makes network access mandatory for every covered task. Search templates interpolate feature names, product names, framework names, and technical topics taken from the user's request or repository.

In a private project, those values can reveal:

• Unreleased product or feature names.
• Internal service and component names.
• Proprietary architecture choices.
• Customer-specific requirements.
• Vulnerability or incident topics.
• Planned migrations and technology versions.

The instructions do not require user consent, confidentiality classification, removal of internal identifiers, destination approval, or a determination that local evidence is insufficient. WebFetch also introduces untrusted external content into the workflow without an explicit rule ...[truncated 1545 chars]

Remediation

View remediation

Remediation Suggestions

1. Make all network research opt-in rather than mandatory.
2. Ask the user for explicit permission before transmitting task-derived terms.
3. Prefer repository documentation, local dependency metadata, and user-provided references.
4. Replace internal product, service, customer, and component names with generic descriptions.
5. Never include source code, stack traces, secrets, personal data, internal URLs, or unique infrastructure identifiers in search queries.
6. Restrict WebFetch to user-approved or official domains.
7. Treat all fetched content as untrusted data that cannot override Agent, Skill, or user instructions.
8. Record the destination, query classification, and reason for external access.
9. Permit an offline workflow when network access is unavailable, unnecessary, or prohibited.
10. Add a confidentiality gate before any search or fetch operation.

T09 · Insecure Skill Coding Practices

Error

• Location: references/testing-sop.md:455

Finding

Chaos-Test Template Can Stop a Database Container and Contact a Hardcoded External Service

Content

View full analysis

Vulnerability Details

File Location: references/testing-sop.md:455-486
Vulnerability Type: Unsafe destructive test automation and hardcoded external target
Risk Level: High

Vulnerable Code Snippet

The executable statements below are reproduced from the source. Comments and human-readable messages are translated into English:

python

# chaos_tests.py — post-deployment chaos test
import subprocess, requests, time, sys

BASE_URL = "https://xinqi.online"

def test_db_disconnect():
    """Simulate a disconnected database."""
    subprocess.run(["docker", "stop", "project-mysql"])
    time.sleep(2)
    resp = requests.get(f"{BASE_URL}/api/emotion/list")
    assert resp.status_code in [200, 503], (
        f"The service must not crash when the database is disconnected: "
        f"{resp.status_code}"
    )
    assert "system busy" in resp.text.lower() or "try again later" in resp.text
    subprocess.run(["docker", "start", "project-mysql"])
    time.sleep(5)

def test_timeout():
    """Simulate a third-party API timeout."""
    # Mock a five-second response delay.
    # Verify that the tested API returns a degraded response within three seconds.
    pass

def test_disk_full():
    """Simulate a full disk."""
    # Fill the disk by writing a large file.
    # Verify that a log-write failure does not crash the service.
    pass

if __name__ == "__main__":
    test_db_disconnect()
    print("All chaos tests passed")

Technical Analysis

The template performs two security-sensitive operations:

1. It stops a locally accessible Docker container named project-mysql.
2. It sends an HTTP request to the hardcoded external target https://xinqi.online.

The template lacks essential controls:

• No confirmation that the container belongs to a disposable test environment.
• No explicit authorization for a disruptive action.
• No verification that the target is ...[truncated 1994 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded domain and container name.
2. Require the target URL and container identifier to be supplied explicitly.
3. Permit destructive tests only when a dedicated confirmation flag is present.
4. Verify that the environment is an isolated, disposable test environment.
5. Refuse to run against production, shared, or unlabeled infrastructure.
6. Wrap the stop, test, and recovery sequence in try/finally.
7. Check subprocess exit status and report failed stop or start operations.
8. Add strict connection and response timeouts to every network request.
9. Ensure restoration occurs even when requests, assertions, or imports fail.
10. Prefer mocked fault injection, network proxies, or ephemeral containers over stopping an existing database.
11. Do not implement disk-full testing by filling a real filesystem; use a bounded isolated volume or mocked write failure.
12. Require an allowlisted target and display the complete action plan for user approval before execution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is configured to trigger on extremely broad phrases such as '写代码', '编码', '设计', and '测试', which overlap with routine development requests. This can cause the skill to activate unexpectedly and steer unrelated conversations into its rigid workflow, effectively acting as a prompt-scope hijack and reducing user control over which behavior is invoked.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

> 完整穷举模板见 `references/templates.md` 第7节（十大域+参数轴+状态机+合并去重+AI穷举指令）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

md

> 完整穷举模板见 `references/templates.md` 第7节（十大域+参数轴+状态机+合并去重+AI穷举指令）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.

md

> 完整穷举模板见 `references/templates.md` 第7节（十大域+参数轴+状态机+合并去重+AI穷举指令）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.

md

> 完整穷举模板见 `references/templates.md` 第7节（十大域+参数轴+状态机+合并去重+AI穷举指令）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

> **完整测试SOP见 `references/testing-sop.md`**（六层框架30+项检查，含用例生成指令、一键测试脚本、异常用例模板、混沌注入矩阵、覆盖率验证、结构化报告）。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md

> **完整测试SOP见 `references/testing-sop.md`**（六层框架30+项检查，含用例生成指令、一键测试脚本、异常用例模板、混沌注入矩阵、覆盖率验证、结构化报告）。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

> **完整测试SOP见 `references/testing-sop.md`**（六层框架30+项检查，含用例生成指令、一键测试脚本、异常用例模板、混沌注入矩阵、覆盖率验证、结构化报告）。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

md

> **完整测试SOP见 `references/testing-sop.md`**（六层框架30+项检查，含用例生成指令、一键测试脚本、异常用例模板、混沌注入矩阵、覆盖率验证、结构化报告）。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 414)May include surrounding context.

md

> **完整测试SOP见 `references/testing-sop.md`**（六层框架30+项检查，含用例生成指令、一键测试脚本、异常用例模板、混沌注入矩阵、覆盖率验证、结构化报告）。

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad and map to common requests such as coding, design, testing, and review, making accidental invocation likely. In skill systems, overbroad triggers can cause unintended execution paths, unexpected file writes, or disclosure of internal workflow content when the user did not intend to activate this capability.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/reverse-design.md (reported line 261)May include surrounding context.

md

审查输出（review-report.md）必须过滤：
- API 密钥/Token
- 数据库连接字符串
- 内部服务器路径（如 `/home/user/.ssh/`）
- 个人隐私信息

---

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document includes chaos-testing instructions that stop a live database container and target a real deployment URL, but it does not prominently warn that these steps can disrupt service availability or damage a shared environment. In the context of an AI agent skill, this is especially risky because an agent may reproduce the steps verbatim against production-like systems, causing self-inflicted denial of service or unintended operational impact.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases listed for auto-loading are very broad generic coding terms such as '写代码', '设计', and '需求分析', which are likely to appear in normal development conversations. This can cause unintended activation of the skill, injecting its behavior and constraints into unrelated sessions and potentially altering agent output without explicit user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description and body are written to operate in Chinese without presenting a language-selection mechanism or documenting that Chinese is a required constraint. In mixed-language environments, this can lead to misunderstanding of safety-relevant instructions, incorrect execution of process steps, or silent user exclusion, especially when the skill is auto-triggered broadly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs writing persistent artifacts such as audit-ledger files and lessons-learned memory entries, but does not clearly require user consent before modifying project files or long-lived memory. In an agentic environment, silent persistence can leak sensitive project context, create unwanted state across sessions, and alter repositories or local workspaces in ways the user did not authorize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger example is broad enough to activate on routine coding requests such as 'help me implement' or 'write code', which can cause the skill to take over normal interactions unexpectedly. In this skill's context, that matters because activation introduces a large prescriptive workflow and can steer the agent into extensive actions and process changes the user did not explicitly request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document title and all operative instructions are written in Chinese, effectively imposing a single language for the workflow. The file does not offer a language choice, opt-in, or a clear region-specific justification for this locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file title and entire SOP are written in Chinese, and the document frames itself as a mandatory execution document for each coding task. Because there is no indication that the user can choose a different language or locale, this creates a natural-language policy concern under the rule for forced language or locale without opt-in.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The SOP explicitly instructs the agent to persist debugging and development 'detours' into .workbuddy/memory/lessons-learned.md in plain language during coding. Such records can easily capture sensitive user prompts, project context, internal paths, error details, credentials, or proprietary logic, creating a durable data-retention channel that outlives the immediate task and may be read by later runs or other tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file is entirely written in Chinese and does not indicate that the language choice is optional, user-selected, or required for a specific region/compliance context. The stated policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill content is written entirely in Chinese and repeatedly instructs the AI to follow that SOP without offering a user-language choice or opt-in. In a general-purpose coding assistant, forcing a single language can mislead users, reduce their ability to verify security-relevant guidance, and create unsafe handoff conditions when the user's expected language differs from the generated requirements, design, or error-handling artifacts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document states the system is constrained to 'pure file system' and 'pure Markdown,' which implies a narrowly local architecture. Later sections rely on WorkBuddy session authentication and define WebSearch/WebFetch behavior, so the actual operational model extends beyond the locally persisted Markdown/file-system boundary described at the top.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/reverse-design.md (reported line 20)May include surrounding context.

md

↓
Skill 触发器（关键词匹配）
   ↓
读取 .workbuddy/skills/ai-coding-exception-control/SKILL.md
   ↓
按 L0-R→L0a→L0b→L1→L2→L3→L4→L5→L6 顺序执行
   ↓

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest presents the skill as a framework that guides coding, requirements, design, testing, and review through layered prompts, templates, and file-based workflow. This design file additionally specifies WebSearch and WebFetch operations with timeout/retry behavior, introducing external network access that is not mentioned in the manifest and is not clearly required by the described local control framework.

Content

No source excerpt is available for this finding.