Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Đặt tên chính xác `SKILL.md`
Security audit
taokynang
Security checks for vulnerabilities and agentic risk
Overview
This is a Vietnamese guide for creating skills with a small local validator, and the risky-looking scanner hits are examples or scope-quality notes rather than hidden unsafe behavior.
Install this if you want Vietnamese guidance for creating skills. When copying its templates into real skills, narrow trigger phrases, add explicit confirmation before external service changes, and run the validator only on folders you intend to inspect.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Đặt tên chính xác `SKILL.md`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
name: anthropic-helper
Code thực thi
name: "my-skill'; system('rm -rf /')"
text ### ✅ ĐƯỢC
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
name: anthropic-helper
Code thực thi
name: "my-skill'; system('rm -rf /')"
text ### ✅ ĐƯỢC
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The frontmatter explicitly sets
language: Vietnamese, which is a natural-language policy constraint that can force a specific language choice. The document does not indicate that this is optional, user-selected, or justified as a region-specific skill.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The suggested trigger phrases such as requests for creating a skill or writing YAML are broad and can overlap with ordinary conversation, causing the skill to activate outside its intended narrow context. Over-broad activation can inject lengthy procedural instructions into unrelated sessions, increasing the chance of prompt interference, reduced model reliability, or accidental use of guidance that is not context-appropriate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file consistently presents headings, instructions, and templates in Vietnamese with no indication that users may choose another language or locale. Under the language-policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example trigger phrases for sprint planning are broad enough to overlap with ordinary workplace language, increasing the chance that the skill auto-activates during general discussion rather than an explicit request for automated planning. Because this example is instructional, it can propagate unsafe trigger design into downstream skills that may create or modify project-management artifacts automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The Notion setup example uses generic trigger phrases like 'setup Notion' and 'create workspace,' which are common requests that may appear in many contexts. If copied into a real skill, this broad matching could trigger workspace creation or modification actions without sufficient confirmation, especially in environments connected to live Notion APIs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template uses a placeholder description ('Su dung khi [trigger phrases]') without requiring specificity, which encourages future skill authors to ship overly broad or undefined activation criteria. In agent skills, vague triggers can cause accidental activation on unrelated user requests, leading to unintended tool use or execution of privileged workflows outside the user’s intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The title and the rest of the document are written as mandatory Vietnamese guidance, and the examples/instructions do not indicate that other languages are allowed or that users may opt into this locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.