T09 · Insecure Skill Coding Practices
Warning
- Location
references/iteration-search.md:30- Finding
Untrusted Web Content Is Ingested Without Prompt-Injection Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Cold Case Investigator
Security checks for vulnerabilities and agentic risk
Overview
This markdown-only true-crime research skill is coherent, but it should be reviewed because it mandates exhaustive searches of people and family networks without enough privacy or untrusted-web safeguards.
Install only if you are comfortable with a skill that performs broad public-web true-crime research. Use it for bounded, source-cited case summaries or fiction research, and avoid requests involving living private people, relatives, witnesses, minors, addresses, contact details, or public accusations. Treat forum and blog material cautiously, and do not let fetched web pages dictate agent behavior or conclusions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
references/search-methodology-enhancements.md:150- Finding
Mandatory Person and Family-Network Profiling Violates Data-Minimization Principles
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Harmful Content Injection
Critical
- Category
- Prompt Injection
- Confidence
- 95% confidence
- Finding
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
- Content
关键词构造示例（日本毒可乐案件）：
text query_keyword_groups = [ "1977 日本 毒可乐 氰化钠 连环投毒 案件 细节 完整版", "1977年 日本 コカコーラ 青酸 殺人 未解決 事件 詳細", "1977 Japan Coca-Cola cyanide poisoning unsolved murder case", "Tokyo Coca-Cola poison 1977 police report official findings", "毒可乐 氰化物 连环杀人 多米诺比萨 案件 解析 podcast" ]
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger conditions are broad enough to activate on common requests such as '调查' or '找找关于 XX 的资料,' which can cause the skill to engage in contexts the user did not intend. Unintended activation matters here because the skill drives extensive web searching, collection, translation, and speculative creative output, increasing the chance of unnecessary exposure to sensitive crime material or inappropriate workflow takeover.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document states that content is translated '为中文输出', and the language-style section further requires use of a specific Chinese register and forms of address. This imposes a language/locale choice on users rather than offering opt-in or alternatives.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
At L110-L111 the document states '只提取，不推理' and '只陈述，不评价', implying a non-analytical extraction phase. However, later sections explicitly require '信息基础分析' to identify logical breaks and create supported deep-search directions (L170), and in creative mode to generate unsupported intuitive speculation (L171, L284-L296). This is an active contradiction in the skill's own documentation about whether it analyzes/infers versus merely extracts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file instructs output in a fixed Chinese format ('卷宗通事') without any indication that the user's preferred language should be respected. This can override user expectations, reduce usability, and cause downstream processing or review errors when users or connected systems expect another language or locale.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow is explicitly designed to exhaustively collect case details, enumerate all people, places, organizations, and contradictions, and continue iterating until saturation. It then adds a speculative track that generates unsupported hypotheses about motives, hidden actors, and links to other cases, which can facilitate doxxing-style research, rumor amplification, and invasive profiling of real individuals under the guise of investigation or creative work.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill hard-codes a country-of-origin language search policy without asking the user whether they want multilingual or jurisdiction-specific searching. While not directly code-execution dangerous, it can override user expectations, expand data collection into jurisdictions the user did not choose, and increase privacy and compliance risk when investigating real people or sensitive cases.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Requiring at least one search in the case country's language every round imposes a mandatory locale policy that can repeatedly broaden data gathering beyond what the user requested. In a true-crime or unresolved-case context, that repeated expansion can increase the chance of collecting personal, defamatory, or otherwise sensitive material from local sources without necessity or consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all operational instructions and templates exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language path is provided. The file does not state that it is intended only for a Chinese-language or region-specific workflow, so the forced locale appears undocumented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The template explicitly requires translated content to be presented as Chinese translation text, and later references Chinese-first source summaries. This is a natural-language locale policy issue because the file mandates a specific language rather than offering the user a choice or documenting a justified regional constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly states that case searches 'must' use the official language of the country where the case occurred, without any indication that the user can opt out or request a different working language. This can override user preference, create unexpected external queries in languages the user did not authorize, and increase privacy, compliance, or safety risk when the topic involves sensitive investigations or legally risky jurisdictions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The protocol hard-codes Chinese as the translation output language without offering a user language choice or documenting a locale-based justification. In a multilingual investigation skill, this can cause user-intent mismatch, reduce accessibility, and increase the risk of downstream misunderstanding if users expect output in another language or need source-faithful review in a different language.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The direct-material workflow says after extraction/classification the case can be '交付主簿，进入侧写阶段' (L345, L352), which indicates movement into profiling/inference work. That conflicts with the earlier hard principle '只提取，不推理' (L110) and with the surrounding framing of this workflow as extraction-focused. Even if the profiling is intended as a later external stage, the documentation as written blurs and contradicts the claimed extraction-only intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The language-style rules require '使用半文半白的中文' and prescribe addressing the user as '君' or '阁下'. This is a locale/style policy choice presented as mandatory, with no user option to select another language or a neutral style.
- Content