T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate_checklist.py:231- Finding
Untrusted checklist metadata is rendered without terminal control-sequence sanitization
- Content
View full analysis
- Remediation
View remediation
Security audit
Review Common Core
Security checks for vulnerabilities and agentic risk
Overview
This is a Chinese-language shared review guide with local JSON validators; it has a limited terminal-output sanitization risk but no hidden execution, network access, persistence, or credential handling.
Reasonable to install for Chinese-language review workflows. Avoid running the validator scripts on checklist JSON from untrusted sources unless terminal-control characters are sanitized or output is captured in a safer viewer.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate_theme_consistency.py:68- Finding
Theme-consistency fields permit terminal output injection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is described as a passive shared reference engine that 'does not run independently,' yet it includes standalone validation scripts that read input and produce outputs/exit codes. This mismatch can mislead reviewers, operators, or policy systems into granting trust to a package with executable behavior that was not transparently declared, increasing the risk of unnoticed script execution or misuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description and all user-facing documentation in this file are written entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains user-facing natural-language guidance exclusively in Chinese, with no indication that other languages are supported or that the Chinese-only scope is intentional. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document title and all operating instructions are written exclusively in Chinese, which effectively constrains use of the skill to a specific language/locale. There is no statement offering a language choice, opt-in, or justification that this is a region-specific skill, so it matches the policy's language/locale violation criterion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title and document instructions are written as a prescriptive review workflow in Chinese, and the file provides no indication that another language is allowed. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is explicitly justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document states that any failed mandatory check should cause the review to fail, but the reference Python logic only appends detailed unresolved items when
detailsis iterable and otherwise relies onpassedvalues without enforcing the richer policy described in the prose. This mismatch can cause incomplete or inconsistent enforcement by downstream tooling, letting non-compliant reviews be marked as acceptable depending on which implementation consumers follow.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is entirely written in Chinese and presents the review principles as the required operating language/style without any opt-in or alternative language guidance. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file includes its primary docstring, usage text, return-code descriptions, and result messages entirely in Chinese, and the runtime output later continues this fixed-language behavior. The policy for SQP-3 applies to all file types and flags language/locale constraints when the skill forces a specific language without offering opt-in or documenting a justified region-specific scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's interactive messages, headings, and validation results are all hard-coded in Chinese, so users cannot opt into another language. That is a natural-language policy issue under SQP-3 because the file enforces one locale in operational behavior rather than offering user choice or documenting a justified regional limitation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The example marks
ending_brevityas passed even though the sample closing text contains下期再见, which the checklist explicitly forbids as broadcast-style ending language. Users often copy examples directly, so this contradiction can normalize prohibited output and weaken enforcement of the anti-broadcast rule.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file contains user-facing natural-language guidance solely in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing instructions solely in Chinese, which can constitute a language/locale policy issue when no opt-in or audience restriction is stated. The file does not mention that it is intended only for Chinese-speaking users or provide an alternative language option.
- Content