T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:119- Finding
Shell Command Injection Through User-Derived Command Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
tangyuan-parenting
Security checks for vulnerabilities and agentic risk
Overview
This parenting skill is mostly coherent, but it handles sensitive child information with unsafe command instructions and weak privacy boundaries.
Review before installing. Use it only in a private workspace, avoid committing or syncing tangyuan-logs, and treat medical content as general guidance rather than professional care. The command examples should be fixed to avoid shell interpolation of user feedback before using the logging workflow with untrusted text.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/log_manager.py:67- Finding
Sensitive Childcare and Health Information Stored in Unprotected Plaintext Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill description and the described behavior do not cleanly match: it advertises broad parenting-plan and knowledge-update functionality, while the concrete operational behavior centers on local log access plus additional undeclared log-listing capability. This mismatch can mislead users about what data will be accessed, stored, or surfaced, especially when handling sensitive child and health information.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md - Accept casual, conversational input — do not require structured format from grandma - Parse generously — extract as much useful information as possible from natural language - If feedback is very brief, still record it; do not demand more detail - Always respond warmly and appreciatively to encourage continued daily feedback - Flag any health concerns (fever, persistent cough, refusal to eat) for parent attention ## Workflow 3: Weekly Report Generation
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to read and write workspace files and references scripts, but it declares no explicit tool scope or permissions. In a skill that handles child caregiving and health-related logs, missing tool scoping increases the chance of unintended file access or writes beyond what the user expects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Broad trigger phrases like common greetings or generic childcare phrases can cause the skill to activate during ordinary conversation without clear user intent. Because this skill may read prior logs, write new entries, or generate reports containing sensitive family and child health information, accidental activation increases privacy and integrity risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The fallback for any 'general parenting question about TangYuan' is underspecified and overly broad, which can route many unrelated or ambiguous queries into this skill. Given the skill's access to profile and caregiving references, broad fallback increases the likelihood of unnecessary sensitive-context loading and overcollection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Allowing weekly report generation to trigger automatically on a vague condition like 'it's Sunday evening' is risky because it may initiate sensitive data aggregation without an explicit user request. In this context, the report may summarize health, behavior, and caregiver observations about a minor, amplifying privacy exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill stores child caregiving, behavior, and health-related logs in workspace files but does not clearly warn users that this sensitive data will be persisted locally. Lack of transparent disclosure undermines informed consent and can expose a minor's personal information to other tools, users, or processes with workspace access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill is written only in Chinese and does not indicate that the user may choose another language or that Chinese is required for a region-specific compliance or operational reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file gives first-aid instructions for choking, burns, and falls without warning that the guidance is general information and not a substitute for emergency services or professional medical care. In a parenting skill, caregivers may act on this advice during a stressful emergency, and incomplete or outdated instructions could delay appropriate treatment or cause harm.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction "All output must be in simplified Chinese" imposes a fixed language requirement. The file does not offer the user a language choice or explain a documented, justified locale restriction, which fits the language/locale policy-violation category.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire template content, headings, and user-facing text are written in Chinese, which imposes a specific language/locale on outputs. The file does not indicate that this is optional, user-selected, or required for a documented region-specific use case.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire report template is written in Chinese and presents all section headings and user-facing text in a single language, with no indication that users can choose another language or locale. This can violate a language/locale policy when a skill imposes one language by default without explicit user opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
A language or locale policy violation can occur when a skill effectively forces a specific language without user opt-in. This file provides all guidance exclusively in Chinese and does not indicate that the skill is intentionally limited to Chinese-speaking users or offer alternative language options.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file’s natural-language interface elements, including the top-level description and usage guidance, are entirely in Chinese. The policy scope here is language/locale choice, and the file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose.
- Content