T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/parallel-executor.js:131- Finding
Unbounded Retention of Task Messages, Context, and Results
- Content
View full analysis
- Remediation
View remediation
Security audit
Parallel Responder
Security checks for vulnerabilities and agentic risk
Overview
The skill is not overtly malicious, but it overstates what it does and describes broad automatic sub-agent/progress behavior without clear limits or user control.
Review this skill carefully before installing. It appears to be a prototype or incomplete implementation: it may tell users that background agents and progress reporting are active when they are not, and its planned sub-agent behavior needs explicit user confirmation, cleanup, cancellation, and retention limits before use in a sensitive environment.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/progress-reporter.js:69- Finding
Unvalidated Progress and Timer Values Permit Process-Level Denial of Service
- Content
View full analysis
{ // 这里应该调用 onReport 获取最新进度 // 简化处理，实际实现需要从任务获取进度 onReport && onReport(); }, interval * 1000); this.activeReports.set(taskId, { interval: reportInterval, config }); return reportInterval; } ``` ### Technical Analysis `createProgressBar()` uses `percentage` directly to calculate arguments for `String.prototype.repeat()`. It does not verify that the value is a finite number within the expected range of 0 through 100. Values below zero or above 100 can make either `filledBars` or `emptyBars` negative, causing `repeat()` to throw a `RangeError`. Extremely large finite values can also request excessive string allocation before the second repeat operation fails. Non-finite values can similarly produce invalid repeat counts. `startPeriodicReporting()` also passes `interval * 1000` directly to `setInterval()` without validating its type or range. Zero, negative, non-finite, or extremely small values can be normalized by the runtime into a very short delay, causing rapid callback execution and excessive CPU usage. Reusing the same `taskId` also overwrites the map entry without clearing the previous timer, leaving the old timer active and unreachable through `stopReporting()`. These issues are exploitable where progress options or reporting configuration can be influenced by an untrus ...[truncated 2065 chars]- Remediation
View remediation
3600) { throw new RangeError('interval must be between 1 and 3600 seconds'); } if (config.onReport !== undefined && typeof config.onReport !== 'function') { throw new TypeError('onReport must be a function'); } this.stopReporting(taskId); const reportInterval = setInterval(() => { config.onReport?.(); }, interval * 1000); this.activeReports.set(taskId, { interval: reportInterval, config }); return reportInterval; } ``` 3. Clear any existing timer before starting another report under the same task identifier. 4. Place report callbacks inside exception handling so one callback failure does not terminate or destabilize the reporting process. 5. Limit the total number of simultaneous reporting timers and apply per-caller rate limits. 6. Ensure all timers are cleared when tasks finish, fail, are cancelled, or when the application shuts down. ]]>
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description presents a broader assistant that classifies tasks and then carries out different execution strategies, including direct reply, execute-and-report, and sub-agent parallel handling with progress updates. The supplied code chunk is much narrower: it classifies text into simple/medium/complex, estimates time, records historical timing error, adapts maxTime thresholds, and prints results in CLI mode. While task classification and time estimation are accurately represented, the major advertised capabilities—parallel response handling, progress reporting, actual execution, and spawning or coordinating sub-agents—are absent from this code. Therefore the description materially overstates what this code chunk actually does.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger keywords are very broad and include everyday phrases, which can cause the skill to activate on routine conversation instead of clearly scoped task requests. In an agent environment, unintended activation can lead to unnecessary tool use, spawning of sub-agents, or execution paths the user did not actually intend.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The examples suggest the skill may engage from generic user prompts without clear gating or consent boundaries. That increases the risk of over-triggering operational behaviors, especially when paired with installation, checking, or writing workflows that may invoke tools or side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill shows saving generated content to a filesystem path without warning about persistence, destination control, or data sensitivity. If users provide confidential content, silent disk writes can create privacy, retention, and unauthorized access risks, especially in shared or long-lived environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file includes user-facing natural-language descriptions in Chinese, beginning with the top-level comment and continuing throughout response strings. Because the skill does not offer users a language/locale choice or justify that it is intentionally region-specific, this creates a language-policy concern under the stated rule.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a zero-wait parallel responder that executes tasks in parallel, starts sub-agents for complex tasks, and reports progress. In this implementation, direct and execute-and-report modes return placeholders, and the sub-agent path only stores task state in a Map; no parallel executor, child agent, or periodic reporter is actually invoked.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The immediateResponse strings shown to users are hardcoded in Chinese, which forces a specific language during interaction. The file does not provide any mechanism for locale selection or indicate that Chinese-only behavior is an intentional, justified scope limitation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The comment and user-facing response indicate that a child agent has been launched and will process the task, including periodic progress reporting. In reality, this function only creates a task ID, stores bookkeeping data in memory, and returns a response; no sub-agent is spawned and no reporting loop is started.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file description and generated progress/completion messages are written in Chinese, indicating the skill forces a specific language for user interaction. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified regional limitation, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Multiple user-visible strings in generateReport are fixed in Chinese, including progress labels and follow-up guidance. There is no opt-in, locale selection, or fallback behavior, so the skill imposes a language choice on users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The completion message, timing label, summary label, and result label are all emitted in Chinese. This is a natural-language policy issue because the skill does not offer a language choice or explain a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language descriptions, keyword triggers, CLI example, and output strings are all in Chinese, which effectively constrains the skill to a specific language. There is no user opt-in, alternative locale support, or documented justification that this is intended to be a region-specific skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The description and most operating instructions are presented in Chinese, and the examples assume Chinese-language interaction, but the document does not offer a language choice or state that the locale is region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file is documented and implemented as a generic progress-reporting utility, but the inline test example reports concrete actions like reading daily files, updating a knowledge base, and archiving files. Those comments/example values imply operational behavior that this module does not perform; it only formats and schedules report callbacks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code includes user-facing natural-language content in Chinese and the usage example also assumes Chinese input, but there is no indication that the skill is region-specific or that users may choose another language. That can violate language/locale policy when a skill implicitly constrains interaction language without opt-in.
- Content
Static analysis
No suspicious patterns detected.