T09 · Insecure Skill Coding Practices
Warning
- Location
references/map_mcp_guide.md:43- Finding
Map MCP Workflow Discloses Business Search Terms Contrary to Its Data-Minimization Guarantee
- Content
View full analysis
- Remediation
View remediation
Security audit
Senior Restaurant Retail Location Decision Analyst
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real restaurant site-selection tool, but it needs review because its map-service privacy promise conflicts with its competitor-search workflow.
Install only if you are comfortable with map queries potentially revealing the target location together with category or competitor search terms. Use trusted JSON/map data, review generated reports before sharing, and avoid rendering reports in systems that allow raw HTML or unsafe link schemes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report_generator.py:127- Finding
Untrusted JSON Values Are Embedded into Generated Markdown Without Escaping or URL Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **发布前替换作者**：`SKILL.md` 的 `author` 字段当前为 `WorkBuddy`，对外发布前请改为你的品牌。
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Forcing Chinese-language output without user choice can create consent and usability issues, especially if the user operates in another language and may misunderstand risk disclosures, data-sharing notices, or decision outputs. In a skill that discusses opt-in for map MCP and business decisions, clarity of user-facing notices matters, so fixed-language behavior increases the chance of uninformed consent or misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list is broad enough to activate on common business terms like 选址, 人流量, and 品类选择, which can cause unintended invocation in unrelated conversations. In this skill, accidental activation is more sensitive because the workflow may progress toward external map MCP usage and disclosure of location data, even if later consent gates are described.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises executable script workflows and references local file inputs/outputs, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates a governance gap: a host agent may grant broader file read/write capability than the skill actually needs, increasing the risk of unintended file access or report output to unsafe locations. In this context the skill is not overtly trying to exfiltrate data, and it includes privacy-minded language, which lowers suspicion of malice but does not remove the least-privilege problem.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list contains broad, common terms such as '地图', '人流量', and '投资回报', which can cause the skill to activate in conversations that are only loosely related. Over-broad auto-activation is dangerous because this skill can lead into collection of sensitive location data and file-backed analysis flows, so accidental invocation increases the chance of unintended data handling or confusing tool use. The skill does contain opt-in language for map data egress, which reduces worst-case impact, but the trigger breadth still expands the attack surface.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill states that it produces a professional Markdown report, and throughout the document all prescribed output content is fixed in Chinese without offering the user a language choice. This can violate language/locale policy when a skill implicitly forces one language instead of asking or allowing opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The dialogue guidance says that hitting certain keywords '即触发' and that the AI will automatically run the workflow, which encourages activation without sufficient scope validation. That is risky because the workflow may progress toward external map-service use and structured business analysis before the agent confirms the user's exact intent, data sensitivity, and consent boundaries. The surrounding skill text includes some consent safeguards for map MCP, so the issue is more about unsafe triggering and workflow initiation than direct malicious behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains natural-language descriptions and user-facing output that are fixed to Chinese, including the module docstring and result labels. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the regional constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language strings that present the skill entirely in Chinese, including the module docstring and later user-facing CLI text, with no indication that language is configurable or limited to a China-specific deployment. Under the language/locale policy, forcing a specific language without user opt-in is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language documentation entirely in Chinese and presents the CLI usage/help context in Chinese, with no indication that the user can select another language. Under the policy rule for language/locale, forcing a specific language without opt-in is a violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The generated report and status messages are hard-coded primarily in Chinese, and the program provides no runtime option for users to choose another language. This is a natural-language policy issue because the skill enforces one locale rather than offering user choice or documenting a justified regional limitation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing instructions and recommendations exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the language/locale policy, forcing a specific language without user choice can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON contains user-facing categorical values and entity names in Chinese, such as "商圈型", "餐饮", and competitor names, with no indication that the skill offers a language or locale choice. The policy requires flagging language or locale constraints when they are forced without user opt-in or explicit justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L111 states '输出强制使用', which is a natural-language requirement forcing a specific output style/terminology. Under the policy rules, forcing a language/locale-related output constraint without offering user choice can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file contains user-facing operational guidance exclusively in Chinese, and there is no indication that users may choose another language or that the Chinese-only constraint is required for a region-specific purpose. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.
- Content