Cinemas

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:15 AM UTC
• Version: 0.1.0

Overview

This skill is a simple nearby-cinema lookup guide, with one packaging issue: it points to an external local response-format file that should be bundled or removed.

Before installing, consider asking the publisher to replace the absolute STANDARD_RESPONSE.md file reference with a packaged relative file so the full response format can be reviewed and will work consistently across machines. The skill otherwise only describes a location-based cinema lookup and includes reasonable privacy guidance for coordinates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20

Finding

Out-of-Package Absolute Local File Reference

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unsafe external local-file dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

[STANDARD_RESPONSE.md](file:///Users/mac_lkm/workspace/trae/100fj/.trae/skills/STANDARD_RESPONSE.md)

Technical Analysis

The skill references an absolute file:// path outside the audited package. The referenced file is not included in the project, so its contents cannot be reviewed or integrity-checked as part of this audit. If an agent follows this reference, external local content may influence the skill's response format and behavior.

The developer-specific path also discloses a local username and workspace structure. Because the dependency is neither packaged nor pinned, behavior may differ between hosts and can be influenced by whoever controls the referenced file. This is an insecure configuration practice rather than evidence of an embedded malicious payload.

Attack Path

1. A user invokes the nearby-cinema skill.
2. The agent processes SKILL.md and encounters the external response-schema reference.
3. The agent attempts to read the absolute local file using its available file-access capability.
4. If the file exists and is controlled or modified by an attacker with local write access, attacker-supplied content can influence the agent's generated response.
5. If the file is absent, the skill may fail to produce its documented response structure.

Impact Assessment

Exploitation requires the attacker to control or modify the referenced local file, or otherwise influence the path's contents. The resulting scope is limited to the permissions already available to the agent: reading the file and allowing its content to affect response generation. The finding does not independently grant system privileges, code execution, persistence, or write access. Additional impacts include disclosure of the developer username ...[truncated 81 chars]

Remediation

View remediation

Remediation Suggestions

1. Include STANDARD_RESPONSE.md within the audited skill package.
2. Replace the absolute URI with a package-relative reference, such as ./STANDARD_RESPONSE.md.
3. Validate and audit the referenced document together with SKILL.md.
4. Do not place executable instructions or untrusted directives in response-schema documents.
5. Restrict file access to the skill package root and reject references that resolve outside it.
6. Remove developer-specific usernames and workstation paths from distributed artifacts.
7. If external resources are unavoidable, enforce an allowlist and verify their integrity before use.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill lists example trigger phrases for nearby cinemas, but it does not clearly define whether these are exhaustive or provide exclusion conditions. This can lead to unintended invocation for loosely related queries about movies or nearby places because the activation scope is not explicitly bounded.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.