T09 · Insecure Skill Coding Practices
Note
- Location
scripts/package_skill.py:36- Finding
Archive Self-Inclusion When Output Is Placed Inside the Source Tree
- Content
View full analysis
- Remediation
View remediation
Security audit
Nima Skill Creator
Security checks for vulnerabilities and agentic risk
Overview
This skill helps build and package skill files and does not show hidden data theft or unsafe automatic behavior, but it can create persistent skill folders when used.
Install only if you want a skill that can create, modify, validate, and package Codex skill folders. Review target paths before running its scripts, especially commands that write under CODEX_HOME or package a directory, and avoid placing package output inside the source skill directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents a broad skill-authoring and improvement system focused on requirement discovery, planning, scaffolding scripts, and validation for building or redesigning skills. The actual code chunk does not implement creation, refactoring, requirement discovery, planning, or scaffolding. Instead, it performs packaging of an already existing validated skill directory into a .zip file. Validation is mentioned in the description, so that aspect is partially aligned, but the primary behavior of this code is packaging/archiving, which is a materially different and undeclared capability relative to the stated purpose. Therefore this chunk is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The code chunk only implements validation of a skill folder’s structure and metadata. It does not create, refactor, scaffold, plan, or redesign skills, nor does it perform requirement discovery. Validation is one component mentioned in the description, but the declared purpose presents a much broader skill-building and transformation capability than what this code actually does. Therefore the description materially overstates the code’s behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Keep `SKILL.md` procedural and concise. Move deep detail into `references/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Keep `SKILL.md` procedural and concise. Move deep detail into `references/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Keep `SKILL.md` procedural and concise. Move deep detail into `references/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Keep `SKILL.md` procedural and concise. Move deep detail into `references/`.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to run local Python scripts and operate on user-supplied paths, but it declares no explicit tool scope or permission boundaries. That increases the chance the skill will perform filesystem writes and shell execution more broadly than intended, especially if a user provides a sensitive or unexpected target path.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Forcing Chinese during requirement discovery without user opt-in can cause misunderstanding of requirements, validation steps, or filesystem targets, which is risky in a skill that creates and modifies files and runs scripts. In security-sensitive or operational contexts, language coercion can undermine informed consent and accurate review even if it is not overtly malicious.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file description says only 'Hybrid skill creation framework with interactive Chinese-guided workflows and English technical documentation,' which is materially narrower than the stated manifest context describing gated requirement discovery, reusable resource planning, executable scaffolding scripts, validation, and multiple redesign patterns. That creates a semantic mismatch between what the skill is presented as doing here and what it is claimed to actually support.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says the skill uses "interactive Chinese-guided workflows and English technical documentation," which indicates a language-specific interaction model. Because it does not mention any user choice, opt-in, or justification for this locale constraint, it appears to force a specific language and may violate language/locale policy requirements.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template tells authors to describe when the skill should activate, but it does not require narrow, testable trigger constraints. In practice, this can lead to overly broad skill routing and accidental invocation in unrelated contexts, increasing the chance that powerful scripts, references, or automation are loaded when they should not be.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Lines L08-L09 instruct authors to place activation guidance in the description, but they do not require specificity, constraints, or negative examples. In a best-practices document, this omission can promote broad or ambiguous trigger descriptions that overlap with ordinary requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is titled and instructed entirely as Chinese-only guidance, including the explicit rule to 'Use plain Chinese' and all prompt examples in Chinese. This imposes a specific language/locale without any opt-in, alternative, or stated region-specific justification, which matches the policy-violation criteria.
- Content