Operation Tracer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

This skill is a local SQLite tracing utility whose sensitive logging behavior is mostly disclosed and purpose-aligned, but users should treat its trace database and exports as potentially sensitive.

Install only if you are comfortable with local trace records containing tool parameters, file paths, prompts, results, and errors. Avoid tracing secrets, protect or delete traces/agent_traces.db when needed, and be careful sharing JSON/CSV exports because they may contain sensitive operational data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tracer.py:52
• Finding: Unredacted Operation Metadata and Results Persisted in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `scripts/tracer.py:52-68`, `scripts/tracer.py:70-89`, and `scripts/tracer.py:91-113` **Vulnerability Type**: Sensitive data exposure through plaintext trace storage **Risk Level**: Medium ### Vulnerable Code ```python def start_span(self, name: str, op_type: str, metadata: dict = None) -> str: """开始追踪一个操作 Args: name: 操作名称 op_type: 操作类型（tool_call / llm_call / error / compression） metadata: 附加元数据 Returns: span_id: 追踪跨度ID """ span_id = str(uuid.uuid4())[:8] span = Span( id=span_id, name=name, start_time=time.time(), metadata=metadata or {}, ) span.metadata["operation_type"] = op_type self._active_spans[span_id] = span return span_id ``` ```python def end_span(self, span_id: str, result: Any = None, status: str = "success"): """结束追踪 Args: span_id: 追踪跨度ID result: 操作结果 status: 状态（success / error） """ if span_id not in self._active_spans: return span = self._active_spans[span_id] span.end_time = time.time() span.duration_ms = (span.end_time - span.start_time) * 1000 span.result = str(result) if result is not None else None span.status = status # 持久化到 SQLite self._save_span(span) # 从活跃列表移除 self._active_spans.pop(span_id, None) ``` ```python def _save_span(self, span: Span): """保存 span 到数据库""" conn = sqlite3.connect(self.db_path) conn.execute( """INSERT OR REPLACE INTO traces (id, timestamp, operation_type, operation_name, duration_ms, metadata, result, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?)""", ( span.id, span.start_time, span.metadata.get("operation_type", "unknown"), span.name, span.duration_ms, json.dumps(span.metadata, ensure_ascii=False), span.result, span.status, ...[truncated 2266 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define an explicit allowlist of safe metadata fields for each operation type instead of persisting arbitrary dictionaries. 2. Recursively redact fields whose names indicate sensitive content, including `password`, `secret`, `token`, `api_key`, `authorization`, `cookie`, and related variants. 3. Avoid storing complete tool or LLM results by default. Store status codes, hashes, sizes, or bounded summaries instead. 4. Apply strict maximum lengths to operation names, metadata values, and results. 5. Make sensitive-content capture an explicit, documented opt-in feature. 6. Create the database and its parent directory with owner-only permissions, such as `0700` for the directory and `0600` for the database where supported. 7. If trace contents must remain recoverable, encrypt sensitive fields using a key held outside the database. 8. Implement and automatically invoke a bounded retention policy rather than relying only on manual calls to `cleanup()`. 9. Apply the same authorization and redaction controls to JSON and CSV exports. 10. Add tests verifying that nested secrets, authorization headers, credentials in URLs, and oversized results are removed or truncated before persistence. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/analyzer.py:139
• Finding: Improper CSV Escaping and Spreadsheet Formula Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyzer.py:139-168` **Vulnerability Type**: CSV injection and malformed CSV serialization **Risk Level**: Low ### Vulnerable Code ```python def export(self, format: str = "json") -> str: """导出追踪数据 Args: format: "json" 或 "csv" Returns: 导出的数据字符串 """ conn = sqlite3.connect(self.db_path) conn.row_factory = sqlite3.Row cursor = conn.execute(""" SELECT id, timestamp, operation_type, operation_name, duration_ms, metadata, result, status FROM traces ORDER BY timestamp """) rows = [dict(row) for row in cursor.fetchall()] conn.close() if format == "json": return json.dumps(rows, ensure_ascii=False, indent=2) elif format == "csv": if not rows: return "" headers = list(rows[0].keys()) lines = [",".join(headers)] for row in rows: lines.append(",".join(str(row.get(h, "")) for h in headers)) return "\n".join(lines) else: raise ValueError(f"Unsupported format: {format}") ``` ### Technical Analysis The CSV export implementation concatenates fields with commas instead of using a standards-compliant CSV serializer. Values containing commas, quotation marks, carriage returns, or line feeds are not escaped or quoted, allowing one stored value to alter columns or create additional records. The exported `result` and `operation_name` fields can be influenced by traced operations. If a field begins with a spreadsheet formula marker such as `=`, `+`, `-`, or `@`, spreadsheet applications may interpret it as a formula rather than text when an analyst opens the exported file. CSV quoting alone fixes record structure but does not reliably prevent formula interpretation. Spreadsheet-targeted exports therefore also require formula neutralization or an export format that preserves explicit data types. ### Attack Path 1. An attacker influence ...[truncated 1180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace manual string concatenation with Python's standard `csv` module: ```python import csv import io output = io.StringIO(newline="") writer = csv.DictWriter(output, fieldnames=headers) writer.writeheader() writer.writerows(rows) return output.getvalue() ``` 2. For spreadsheet-targeted exports, neutralize cells whose first non-whitespace character is `=`, `+`, `-`, or `@`. A common mitigation is to prefix such values with an apostrophe, while clearly documenting that transformation. 3. Consider exporting potentially attacker-controlled values in JSON instead of CSV when exact content preservation is required. 4. Validate and limit the size of all exported fields. 5. Add tests covering commas, quotation marks, CRLF sequences, multiline values, Unicode content, and formula-leading characters. 6. Warn users that exported trace content is untrusted and should not be opened with spreadsheet features such as automatic external-link updates enabled. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description emphasizes a tracing system whose purpose is to record operational events into SQLite. This code chunk does not perform recording/instrumentation of tool calls, LLM calls, errors, or compression operations. Instead, its primary function is post hoc analysis and maintenance of an existing traces table: generating statistics, retrieving slow/error operations, exporting stored traces, and cleaning up old entries. While these behaviors are related to trace data and post-analysis, they are materially different from the stated core behavior of recording all calls. Therefore the description does not accurately represent this code chunk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises comprehensive tracing of tool calls, LLM calls, errors, and compression events with SQLite persistence, but does not clearly warn that this can capture and retain sensitive metadata such as file paths, prompts, arguments, results, and timing data. In an agent environment, such telemetry can accumulate secrets or operationally sensitive information and make later compromise, misuse, or over-collection more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The export function returns complete trace records including metadata and result fields, which commonly contain tool inputs/outputs, prompts, error details, or other sensitive operational data. In a tracing system, bulk export without redaction, access control, or even an explicit sensitivity warning materially increases the risk of accidental disclosure or exfiltration of secrets and internal data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cleanup method deletes database records with a DELETE statement and commits the change, making the operation destructive and not easily reversible. The docstring describes retention days but does not warn that old trace data will be permanently removed.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: This code file contains user-facing natural-language documentation and comments entirely in Chinese, including the module docstring and method/class descriptions, without offering any language choice or documenting a justified locale constraint. The policy explicitly flags forced language or locale behavior when there is no user opt-in or clear region-specific rationale.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The user-facing description and instructional content are written entirely in Chinese, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking audience. This can violate language or locale policy when a skill implicitly forces one language without user opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file presents the schema description entirely in Chinese, including the title and all explanatory text, with no indication that the language is optional or required for a region-specific purpose. Under the policy for natural-language violations, forcing a specific language without user opt-in should be flagged.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: Natural-language strings in the module header and all user-oriented docstrings are written exclusively in Chinese, which effectively constrains the skill to a single language. The file does not indicate that language selection is optional or that the locale restriction is intentional for a region-specific use case.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The module docstring and surrounding natural-language comments are written only in Chinese, and there is no indication that the skill or tests are region-specific or that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language locale violation.

Static analysis

No suspicious patterns detected.