T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/classifier.py:183- Finding
Unredacted Exception Data Exposed Through Logs and Action Messages
- Content
View full analysis
- Remediation
View remediation
Security audit
Error Classifier
Security checks for vulnerabilities and agentic risk
Overview
The skill is a small error-classification helper with no evidence of credential access, network activity, persistence, or hidden behavior, though it can echo raw exception text into messages and logs.
Reasonable to install for local error classification. Use caution when integrating it with APIs or production systems: raw exception strings may include tokens, headers, URLs, or private paths, so add redaction before forwarding messages to users, models, logs, or telemetry.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ---- PERMANENT（永久错误）---- def test_permission_denied_is_permanent(self): error = Exception("Permission denied: /etc/shadow") self.assertEqual(self.classifier.classify(error), ErrorType.PERMANENT) def test_403_is_permanent(self):
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description and main skill content are written entirely in Chinese and present the skill behavior in that language without offering an alternative language or stating that the skill is region-specific. This can violate a language/locale policy when users are not explicitly given a choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains natural-language documentation and operational messages entirely in Chinese, including the module docstring and later user-facing action messages. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file is written entirely in Chinese and does not indicate that the user may choose another language or that the content is intentionally restricted to a Chinese-speaking or region-specific audience. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring and comments are written primarily in Chinese, which imposes a specific language for maintainers or users reading skill internals. The policy calls for flagging language or locale constraints when the skill does not offer a language choice or document a justified region-specific need.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language documentation entirely in Chinese, including the top-level docstring and many test descriptions, with no indication that the skill supports other languages or that Chinese is a required locale. Under the policy rule for language/locale constraints, this constitutes a forced language choice without user opt-in or documented justification.
- Content