T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:14- Finding
Plaintext HTTP Search and Unverified File Downloads
- Content
View full analysis
- Remediation
View remediation
Security audit
Reformed Books Search & Download
Security checks for vulnerabilities and agentic risk
Overview
The skill is a small, disclosed helper for searching a third-party book site, with no hidden persistence or destructive behavior, but its HTTP download workflow requires caution.
Install only if you are comfortable using a third-party HTTP book site. Treat all downloaded files as untrusted, verify the source when possible, scan files before opening them, avoid enabling active document content, and consider copyright or licensing before downloading materials.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个能够搜索和下载书籍的技能，暗示会实际返回搜索结果，并对 PDF 进行优先处理。但代码中的 search_books 明确注释说明由于网站使用 JavaScript 前端搜索，无法直接通过 HTTP 获取结果，因此函数只打印操作说明、相关链接，并返回空列表。main 也仅输出这些说明或一个包含空 results 的 JSON。虽然定义了 HTML 解析器和 format_results，可用于处理结果和 PDF 排序，但这些能力没有接入主流程，未构成实际行为。因此，代码的真实主要用途是“提供手动搜索指导并检测网站可访问性”，与声明的“搜索和下载书籍”存在实质不符。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill instructs use of a browser tool and a Python script to access external network resources, but it does not declare any explicit tool scope or permissions. This weakens governance and review because the runtime capabilities exceed what is formally documented, making unintended or unsafe network access easier to miss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly tells users to click filenames to directly download files from an external site, but gives no warning about file trust, malware risk, copyright concerns, or verification steps. Because the skill is centered on retrieving downloadable documents from a third-party site, this context increases risk: users may treat the workflow as endorsed and download untrusted content without scrutiny.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language descriptions, CLI help text, and output strings are entirely in Chinese, which imposes a specific language/locale on users without any opt-in or alternative. The file does not indicate that the language constraint is optional or justified as a region-specific requirement.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The docstring for search_books states that it searches books and returns a search result list. However, the implementation comments at L94-L95 and the body show it does not perform the search and always returns the initially empty results array after printing guidance.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a capability to search and download Reformed/Christian theology books, prioritizing PDF results. In practice, the code only prints manual browser instructions and performs a basic site-availability check, then returns an empty results list instead of executing a search or download flow.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The manifest description is entirely in Chinese and frames the skill's usage in Chinese-language terms, with no indication that users may choose another language or that the Chinese-only behavior is intentional and justified. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear documentation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The script makes an outbound request to an external website without clearly disclosing that user-triggered execution will contact a third party. Although only the base site is contacted and the search keywords are not transmitted in this code path, this still creates an unexpected privacy and trust concern because it leaks the user’s IP/user agent and may surprise users in sensitive environments.
- Content
Static analysis
No suspicious patterns detected.