T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init_context_project.py:99- Finding
Unvalidated Project Name Enables Path Traversal and Arbitrary File Creation
- Content
View full analysis
- Remediation
View remediation
Security audit
Context Engineering For Projects
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent documentation purpose, but its scaffold script can create persistent files outside the intended project folder if given an unsafe project name.
Install only if you are comfortable with the skill reading a chosen code directory and creating persistent context files. Use simple project names containing only letters, digits, dots, underscores, or hyphens, and avoid using untrusted text as the project name until the script validates path containment and escapes Markdown.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/init_context_project.py:26- Finding
Project Name Allows Persistent Markdown and Agent-Context Injection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill directs the agent to populate and modify project files, including SKILL.md and multiple generated documents, based on analysis of a user-specified codebase and target root. Even if the bundled script is described as idempotent, the workflow still authorizes broad repository and workspace modification, which can alter prompts/configuration-like files and create persistence in locations the user may not expect.
- Content
md --target-root <target_root> ``` - The script infers module buckets from the codebase and creates module folders dynamically. - The script is idempotent: it won’t overwrite existing files. 4. **Populate content (critical)** - Fill `skill.md` (L1) with **project summary, architecture, entrypoints, build/run, module navigation**.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill clearly instructs reading from a user-supplied code directory and writing a scaffold under a target root, but it declares no explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity where an agent may perform file read/write actions more broadly than intended, increasing the chance of unintended filesystem access or writes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation text includes broad English phrases like 'create project context' and 'set up team context' that can overlap with many normal documentation or project-setup requests. Over-broad triggering can invoke this skill unexpectedly, causing unsolicited codebase scanning and filesystem writes in contexts where the user did not specifically intend this operation.
- Content
Static analysis
No suspicious patterns detected.