T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/collect_categories.py:131- Finding
Spreadsheet Formula Injection Through Unsanitized CSV Fields
- Content
View full analysis
- Remediation
View remediation
Security audit
Category Link Collector
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward category-link parser that writes CSV files, with some file-handling and CSV-safety caveats users should understand before use.
Install only if you are comfortable with a Chinese-language CSV utility that writes files locally. Override the default output directory before use, avoid running the included tests on shared systems without reviewing the /tmp cleanup path, and treat generated CSVs as untrusted if links can come from other people because spreadsheet apps may evaluate formula-like cell contents.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (19)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Skill主文件: `SKILL.md`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The test performs a recursive deletion of a hard-coded directory using shutil.rmtree on /tmp/test_category_collector. Recursive deletion is dangerous because if the target path is changed, replaced with a symlink, or reused by another process, the test could delete unintended files or directories on the host running the tests.
- Content
python # 确保目录不存在 if os.path.exists(test_dir): import shutil shutil.rmtree("/tmp/test_category_collector") test_links = ["https://example.com/collections/test"]
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
This cleanup step again recursively deletes a fixed directory tree under /tmp. In shared or CI environments, deleting predictable filesystem locations can interfere with other processes or remove attacker-planted content if path ownership and resolution are not validated.
- Content
python # 清理 import shutil shutil.rmtree("/tmp/test_category_collector") if __name__ == "__main__":
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description and feature list are presented in Chinese, including a stated feature of providing Chinese headers, but the README does not offer an English or user-selectable language option. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless it is clearly justified as region-specific.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises behavior that reads inputs and references network URLs, and it also writes output files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a trust and review gap: an agent may invoke file or network-capable tooling without the user being clearly warned or the runtime being constrained, increasing the chance of unintended data access or outbound requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that it saves extracted data to CSV and even includes a default absolute path, but the description does not clearly warn users that local disk writes will occur. This can cause unintentional disclosure or persistence of scraped data on the host system, especially if the default directory is sensitive, shared, synced, or unsuitable for the current environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's docstring, comments, and all user-facing print messages are in Chinese, which imposes a specific language on users. Under the policy rule, this is a natural-language locale constraint and there is no opt-in, fallback, or documented justification that the skill is region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file contains multiple natural-language strings such as the module docstring, function docstrings, and printed output exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents the skill usage solely in Chinese ('使用示例'), and the rest of the document continues in that language without any opt-in, alternative language, or justification that the skill is region-specific. Under the policy, forcing a specific language without user choice is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s module docstring and later user-facing console messages are written only in Chinese, which imposes a specific language on users without opt-in. Under the policy, language/locale constraints should either be optional for the user or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains multiple user-facing strings in Chinese, including the module docstring and all printed test status messages. The file does not provide any user opt-in, fallback, or explanation that the skill is intentionally limited to Chinese-speaking users, which is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language content in the docstring, comments, and user-facing print statements is entirely in Chinese, with no indication that language is configurable or selected by user preference. Under the policy, forcing a specific language without opt-in is a locale/language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring, comments, and test descriptions are written in Chinese throughout the file. This creates a language-specific constraint in natural-language content without any indication that Chinese is required or any opt-in/alternative language support.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The user-facing description and operational instructions are written entirely in Chinese, with no indication that other languages are supported or that the locale is intentionally restricted. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the constraint is explicit and justified.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script writes output to a hard-coded absolute local path, which is unsafe and brittle in an agent skill because it can overwrite files in an unintended user directory, fail on other systems, or leak collected data into a location the caller did not approve. In this context the risk is limited because the path is fixed rather than attacker-controlled, but it still violates least surprise and safe file-handling expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language strings and docstrings throughout the file are written in Chinese, with no indication that language choice is optional or region-specific. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This code reads arbitrary file contents from a provided path, but there is no confirmation prompt, warning comment, or user-facing disclosure about accessing local files. For code-file warning checks, local file access that touches user data should be disclosed unless clearly documented as expected behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This Python code performs a file-output operation by setting an output directory and invoking a collection function that returns a CSV path, but the script provides no prior warning or confirmation before writing data. While it prints status messages, those messages do not disclose beforehand that files will be created in a specific local path.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code creates directories under /tmp and later recursively deletes /tmp/test_category_collector via shutil.rmtree, which is a destructive filesystem operation. While it is test code, there is no visible warning, log, or explanatory comment near the deletion to disclose that the test modifies and removes filesystem state.
- Content
Static analysis
No suspicious patterns detected.