T09 · Insecure Skill Coding Practices
Error
- Location
- skill_scan.py:72
- Finding
- Security Scanner Excludes Skill Instruction and Documentation Files<![CDATA[ ## Vulnerability Details **File Location**: `skill_scan.py:72-76` **Vulnerability Type**: Incomplete security scanning caused by extension-based exclusions **Risk Level**: High ### Vulnerable Code ```python # 扫描所有文件 for file_path in skill_path.rglob('*'): if file_path.is_file(): # 跳过文档和示例文件 if file_path.name in ['SKILL.md', 'README.md', 'CHANGELOG.md']: continue if file_path.suffix in ['.md', '.txt', '.rst']: continue ``` ### Technical Analysis The scanner recursively enumerates files but deliberately excludes `SKILL.md`, named documentation files, and every file with a `.md`, `.txt`, or `.rst` extension. In an AI-agent skill, `SKILL.md` is not merely passive documentation. It can define instructions that influence the agent when the skill is loaded. Malicious instructions could attempt to override existing constraints, direct the agent to access credentials, execute commands through available tools, retrieve external content, or alter its current goals. Because these files never reach `scan_file()`, none of the scanner's dangerous-command, sensitive-path, or network-request checks are applied to them. An instruction-only malicious skill can therefore receive an `[OK]` result. This also conflicts with the documented claim that the tool scans all installed skills. The issue is a security-control bypass and false-negative condition rather than evidence that this project itself contains malicious instructions. No command execution, data exfiltration, persistence, credential theft, or direct SSH-key access was found in the audited project. The SSH path present in the source is only a detection pattern. ### Attack Path 1. An attacker creates a skill whose executable scripts appear benign or are absent. 2. The attacker places harmful agent instructions or dangerous command guidance in `SKILL.md` or another excluded text file. 3. A user installs the attacker-controlled skill under the configured sk ...[truncated 1288 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the blanket exclusions for `SKILL.md`, `.md`, `.txt`, and `.rst` files. Treat readable text files as security-relevant input regardless of whether they are documentation or code. 2. Always scan the primary skill manifest and instruction files, including `SKILL.md`, before scanning executable files. 3. Add instruction-specific detection rules for: - Attempts to override higher-priority instructions or safety constraints. - Requests to disclose credentials, tokens, private keys, or sensitive files. - Directions to execute shell commands or invoke privileged tools. - Remote payload retrieval or untrusted URL access. - Persistence, memory modification, or configuration tampering. - Attempts to conceal actions or suppress user confirmation. 4. Distinguish findings discovered in executable code from findings discovered in agent instructions, but do not exclude either category. 5. Replace filename-only binary detection with content-aware classification, such as MIME inspection or checking for null bytes, so attackers cannot bypass scanning through misleading extensions. 6. Add regression tests containing dangerous commands and instruction-hijacking text in `SKILL.md`, `README.md`, `.txt`, and `.rst` files. Verify that each test produces a finding rather than an `[OK]` result. 7. Clearly state the scanner's limitations and avoid presenting a clean regex scan as proof that a skill is safe. ]]>