T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/learner.py:54- Finding
Persistent Plaintext Storage of Potentially Sensitive Legal Consultation Data
- Content
View full analysis
- Remediation
View remediation
Security audit
meta-legal-assistant-pro
Security checks for vulnerabilities and agentic risk
Overview
This China-law assistant is not malicious, but it needs review because it can persist legal-use notes and preferences in plaintext and its learner can write state into arbitrary skill directories.
Review before installing. Avoid letting this skill store confidential case facts, identity details, contract terms, or dispute notes unless you are comfortable with plaintext local retention. Prefer a version that scopes learning to its own directory, asks before saving data, redacts sensitive content, and provides inspect/delete controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill presents itself as a specialized Chinese legal meta-assistant with safety boundaries, self-verification, and orchestration features, but the analyzer indicates the actual behavior is generic cross-skill learning and preference storage instead. This mismatch is dangerous because users and parent agents may grant trust, invoke it for sensitive legal matters, or allow persistence under false assumptions about scope, safeguards, and purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill metadata does not declare any tool restrictions, yet the package is reported to have file_write capability elsewhere. That creates an undeclared capability gap: a user or orchestrator may treat this as a text-only legal assistant while it can persist data or modify files, which increases the risk of unauthorized data storage, prompt-memory poisoning, or unexpected side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file defines the skill as a comprehensive 'Chinese law' assistant and all descriptive content is presented only in Chinese, without indicating that users may choose another language or that the locale is optional. This can be a natural-language policy issue when the skill imposes a language/locale context rather than offering user choice or explicitly documenting a justified region-specific constraint.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invocation text says to directly call the skill for broad legal consulting, contract review, and rights-protection guidance without clear trigger boundaries. Overbroad invocation increases accidental activation, misuse outside intended conditions, and routing of sensitive matters into a skill whose true capabilities are already in doubt, amplifying privacy and reliability risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring, CLI description, comments, and user-facing usage/help text are all presented only in Chinese. This imposes a specific language on users without any opt-in or documented locale constraint, matching the language/locale policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
resolve_skill_dir 支持按名称解析 ~/.workbuddy/skills 下的任意技能目录，结合后续 record/prefer/save 操作，意味着该脚本可为任意 WorkBuddy 技能记录操作历史、错误模式和用户偏好。这种通用跨技能遥测/画像能力并非法律咨询或法律工作流本身的直接必要能力，且 manifest 未单独说明。
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Manifest 将该技能描述为面向中国法域法律辅助与工作流增强的元技能，重点是法律模块、编排、自验证和安全边界；但该文件实现的是一个与业务无关的通用学习器，并会在传入的任意技能目录写入 learned_patterns.json。对其他技能目录进行持久化状态修改并不是该法律助手描述中显式体现的能力，而是额外的跨技能自演化基础设施行为。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all user-facing content in a single language and does not offer an opt-in or explain that the skill is intended only for a Chinese-language audience. Under the policy, forcing a specific language without user choice is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The JSON stores the capability name exclusively in Chinese ("蒸馏增强") in user-relevant metadata fields. Because this file provides no indication of user language choice, opt-in, or region-specific justification, it may violate the policy against forcing a specific language or locale.
- Content
Static analysis
No suspicious patterns detected.