T09 · Insecure Skill Coding Practices
Error
- Location
src/repro_pack/pipeline.py:60- Finding
Raw sensitive input is propagated into unredacted derived output files
- Content
View full analysis
- Remediation
View remediation
Security audit
support-to-repro-pack
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to sanitize support cases, but its pipeline can still place sensitive raw details into generated files that users may share.
Review before installing and avoid using it on real customer tickets, logs, screenshots, or credentials until the raw-derived output paths are redacted and a final whole-pack scan blocks leaks. Use private per-run temp/output directories, inspect every generated file and ZIP before sharing, and pin dependencies for reproducible installs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:45- Finding
Predictable shared temporary files permit symlink clobbering and cross-run data exposure
- Content
View full analysis
> /tmp/repro_sanitized_ticket.md # Redact PII from logs python -m repro_pack redact > /tmp/repro_sanitized_logs.txt # Parse log structure python -m repro_pack parse --format json > /tmp/repro_parsed_logs.json # Extract environment facts python -m repro_pack extract > /tmp/repro_facts.json # Build event timeline python -m repro_pack timeline --format json > /tmp/repro_timeline.json # Extract stack traces python -m repro_pack traces > /tmp/repro_traces.json # Run PII audit to verify redaction completeness python -m repro_pack redact --audit --format json > /tmp/repro_audit.json ``` ### Technical Analysis The documented mandatory workflow writes artifacts to fixed, globally predictable paths under `/tmp`. Shell output redirection normally opens an existing target with truncation and follows symbolic links. It does not provide exclusive creation, ownership validation, or symbolic-link protection. On a multi-user system, another local user may pre-create one of these paths as a symbolic link. When the Skill executes the documented command, the invoking process can overwrite the symlink target using its own permissions. Even without symlinks, concurrent executions use the same filenames and can overwrite, mix, or read another run's support data. Several temporary outputs contain structured data derived from raw inputs, including parsed logs, facts, timelines, and traces. Consequently, predictable paths create both integrity and confidentiality risks. ### Attack Path 1. A local attacker predicts the documented path, such as `/tmp/repro_parsed_logs.json`. 2. Before the Skill runs, the attacker creates that path as: - A ...[truncated 1457 chars]- Remediation
View remediation
"$REPRO_TMP/sanitized_ticket.md" python -m repro_pack parse "$log_file" --format json > "$REPRO_TMP/parsed_logs.json" ``` 3. **Avoid shell-managed temporary files where possible** - Add a Python orchestration command that creates temporary files through `tempfile.TemporaryDirectory()`. - Open files with exclusive creation semantics and restrictive permissions. - Do not follow existing symbolic links. 4. **Validate ownership and file type** - If an existing path must be reused, reject symbolic links and files not owned by the current user. - Keep the temporary directory inaccessible to other users. 5. **Clean up reliably** - Remove the entire per-run temporary directory on success, failure, interruption, and termination. - Avoid retaining raw-derived artifacts longer than necessary. 6. **Add concurrency and symlink tests** - Verify that parallel runs use distinct paths. - Verify that pre-created symbolic links cannot redirect writes. - Confirm temporary artifacts are created with permissions that prevent access by other users. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill converts support tickets, logs, and screenshots into sanitized engineering issue packs with repro steps and summaries. However, the supplied code is an evaluator/comparator module.
compare_factsscores how well an already-producedactualfact set matches anexpectedone.compare_redactionscans original/sanitized text for PII and scores recall of redaction.check_completenesschecks whether specific output files already exist in an output directory. These behaviors are consistent with a testing or grading harness for such a skill, not the skill itself. There are no triggers implemented, no parsing of screenshots, no generation of issue packs, no creation of summaries, and no actual sanitization logic beyond checking whether sanitization succeeded. Therefore the code’s primary purpose materially differs from the declared purpose.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on processing customer bug reports, sanitizing logs, producing reproduction steps, and packaging issues for engineering handoff. The supplied code does none of that. It does not parse tickets, logs, or screenshots; it does not sanitize data; it does not generate repro steps or support escalation summaries. Instead, its sole purpose is to render evaluation/scoring results into markdown and JSON reports. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose describes a production-facing transformation utility for support artifacts into sanitized reproducible engineering issue packs. The supplied code does not implement that workflow directly. Instead, it is an evaluation script for testing another pipeline (
run_pipeline) across example cases, comparing outputs to expected results, checking completeness, and writing evaluation reports. While it references artifacts like tickets and logs and indirectly invokes a pipeline that may do the declared task, this code chunk’s primary purpose is benchmarking/scoring, which is materially different from the declared user-facing behavior. No suspicious extra permissions are evident, but the behavior is still mismatched because the main capability is evaluation, not issue-pack generation.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear mismatch. The declared purpose centers on transforming customer support artifacts into sanitized engineering issue packs with repro steps and summaries. The supplied code does none of that: it only models scoring data structures and computes percentages/aggregates for evaluation results. It does not ingest tickets, logs, or screenshots, perform sanitization, generate repro steps, or create issue handoff packs. The code’s primary purpose is unrelated evaluation/scoring logic, so the description does not accurately represent the actual behavior.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The log line exposes a bearer token in plaintext alongside an IP address and stack-trace context, which is sensitive authentication material that could be reused by anyone with log access. In this skill’s context, the danger is increased because the stated purpose is to sanitize logs and convert them into issue packs; if secrets are not reliably redacted before sharing, the skill could propagate credentials to broader engineering or support audiences.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The ticket contains multiple categories of highly sensitive data in plain text, including a phone number, email address, tenant identifier, national ID number, an apparent password, and an API token. In the context of a skill whose purpose is to sanitize tickets and generate engineering issue packs, retaining this raw data creates a strong risk of credential misuse, privacy violations, cross-system correlation, and accidental propagation of secrets into downstream issue trackers, logs, or model prompts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promotes ingestion of customer tickets, logs, chat records, and screenshots containing potentially sensitive data, but it does not prominently warn users about privacy limitations, retention, or the risks of sending raw material to the skill before sanitization is complete. Because the skill handles high-sensitivity support artifacts, missing upfront privacy guidance increases the chance of accidental exposure of PII, credentials, or internal data during use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README suggests triggering the skill with broad natural-language phrases like '帮我整理这个客户 bug' and 'turn this ticket into an engineering issue'. In an agent environment, such generic phrases can cause unintended invocation during ordinary support conversations, leading the skill to process sensitive tickets, logs, or screenshots without the user clearly intending to start the workflow.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to read user-supplied files, write temporary/output files, and run external commands, but it declares no explicit tool scope or permission boundaries. That creates an overprivileged and ambiguous execution surface where the runtime may grant broader file or network access than users expect, increasing the chance of data exposure when processing sensitive tickets and logs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Several triggers such as 'sanitize these logs' and 'generate a repro pack' are broad enough to match routine requests outside a tightly controlled support-escalation workflow. Overbroad activation can cause the skill to ingest sensitive files, perform redaction/writing actions, or produce customer-facing outputs in contexts where the user did not intend this higher-risk processing.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The instruction to generate a complete engineering issue 'without asking any questions' pushes the agent toward autonomous judgment despite potentially missing or contradictory data. In a workflow handling sensitive support artifacts, this can lead to fabricated details, incorrect severity, misdirected escalations, or unsafe customer communications presented as authoritative.
- Content
md Using the templates in `templates/`, generate three documents: 1. **Engineering Issue** (`templates/engineering_issue.md`): Fill in ALL fields. Replace every `[NEEDS_AI_REVIEW]` placeholder with your analysis. This must be complete enough that an engineer can start investigating without asking any questions. 2. **Internal Escalation** (`templates/internal_escalation.md`): Write a concise summary for support leads and PMs. Include severity, impact scope, and recommended actions.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The pipeline opens support tickets and log files, reads their full contents, and aggregates them for parsing and redaction. Although the module docstring describes the pipeline generally, there is no confirmation prompt, user-facing log/print, or inline warning near these operations that the skill will ingest potentially sensitive ticket and log data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The human-readable report includes
m.original_snippet, which appears to be the original matched PII value. That defeats the purpose of sanitization by re-exposing sensitive data in the generated issue pack or summary, which may then be shared with engineers, support, or third parties who should only receive redacted content.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code file performs a file write by saving eval_report.json, but the only surrounding language is an implementation comment and a completion message after the fact. There is no prior confirmation, cautionary note, or docstring disclosure that running the CLI will create or overwrite a report file outside the examples directory.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 43% confidence
- Finding
The file includes locale-specific personal and organizational identifiers such as a Chinese personal name and .cn email domain, which may indicate an implicit region/language assumption in skill-related content. However, there is no explicit instruction or policy text forcing a language or locale, so this is only a weak natural-language policy concern.
- Content
Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 73% confidence
- Finding
Wheel is also left unpinned in the build-system requirements, creating uncertainty about whether vulnerable versions may be selected during packaging. Although the exposure is primarily in build/release environments rather than end-user runtime, build-time path traversal or similar flaws can still affect CI integrity and artifact safety.
- Content
Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 73% confidence
- Finding
Wheel is also left unpinned in the build-system requirements, creating uncertainty about whether vulnerable versions may be selected during packaging. Although the exposure is primarily in build/release environments rather than end-user runtime, build-time path traversal or similar flaws can still affect CI integrity and artifact safety.
- Content
Unverifiable Dependency: click has 1 known advisory(ies) (CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The manifest specifies click with a lower-bound range (>=8.1) rather than pinning or constraining to a known-safe version, so dependency resolution could install a vulnerable release covered by an advisory. In a skill that processes support tickets, logs, and screenshots and likely exposes CLI-driven workflows, a vulnerable command-handling library can increase risk because untrusted user-derived content may flow into command interfaces or plugin behavior.
- Content
Unverifiable Dependency: jinja2 has 16 known advisory(ies) (CVE-2019-10906 (Jinja2 sandbox escape via string formatting); CVE-2014-1402 (Incorrect Privilege Assignment in Jinja2); CVE-2025-27516 (Jinja2 vulnerable to sandbox breakout through attr filter selecting format metho) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Jinja2 is included with only a minimum version (>=3.1), leaving room for installation of versions affected by known sandbox escape and template-related vulnerabilities. This skill's purpose—transforming potentially sensitive support artifacts into issue packs—makes templating more security-relevant because attacker-controlled ticket text, logs, or metadata could be rendered into templates, amplifying the impact of a vulnerable templating engine.
- Content
Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- examples/case_hard/input_ticket.md:17
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- tests/conftest.py:23
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- tests/test_redactor/test_patterns.py:44