T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update-free-models.py:58- Finding
Existing Configuration Can Be Overwritten and Files Are Modified Before User Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Free Buddy Skills
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its stated purpose, but it should be reviewed because its updater can modify WorkBuddy model configuration before consent and can overwrite a damaged config without backup.
Review this skill before installing if you rely on an existing WorkBuddy model setup. Back up ~/.workbuddy/models.json first, run the updater interactively, decline unexpected changes, and avoid installing from an unpinned remote branch unless you trust the publisher and repository.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README tells users that WorkBuddy will automatically query remote model lists and modify
~/.workbuddy/models.json, but it does not clearly warn that a local configuration file will be changed. This can lead users to authorize actions that alter their environment or trust model endpoints they did not manually review, increasing the risk of unsafe configuration changes or supply-chain exposure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README recommends automatic installation from GitHub/Gitee without any guidance to review the downloaded skill, verify the source, or pin a trusted revision. In an agent-skill context, encouraging direct remote installation is risky because the installed content can execute later with local user permissions, making supply-chain compromise more dangerous.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The skill documents capabilities to fetch remote data and read/write a local configuration file, but it does not declare an explicit tool scope or permissions boundary. In an agent environment, this creates an authorization ambiguity that can allow the skill to perform network and filesystem actions without transparent review, increasing the chance of unintended or over-broad access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases include generic terms like '免费 AI 模型', 'free model', and 'opencode.ai', which can match routine conversation and invoke the skill outside a clearly intended context. Because the skill performs network retrieval and local config modification, accidental invocation could cause unexpected filesystem changes or external requests.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
All user-facing instructions and trigger phrases are presented only in Chinese, including the exact phrases users are told to send to WorkBuddy. This can constitute a language/locale policy issue because no alternative language option or justification for a Chinese-only scope is provided.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The documentation asserts that the script requires user confirmation before modifying configuration, but the recommended invocation shows direct execution with no visible confirmation mechanism in this file. That mismatch can mislead users into running a script that changes local config immediately, undermining informed consent and safe-change expectations.
- Content