T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/json_repair.py:84- Finding
Schema Validation Bypass and Fail-Open Processing
- Content
View full analysis
- Remediation
View remediation
Security audit
structured-extraction
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does JSON extraction, but it also includes persistent cross-session learning files and a schema validator that can accept invalid output.
Review before installing. Use the JSON repair helper only on public or authorized data, do not treat its schema validation as authoritative, and avoid using learner.py with sensitive notes, preferences, or shared skill directories unless persistence is explicitly acceptable.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is structured extraction, but the skill also describes a persistent learning system that records usage history and writes learned_patterns.json across sessions, including operation against local skill directories. This mismatch hides stateful data collection and local file manipulation from users, which can expose sensitive content, create unauthorized persistence, and violate least surprise in a data-processing skill.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file implements a generic cross-skill telemetry and self-learning module that is not necessary for a structured-extraction skill. Because it can be invoked for arbitrary skills and is designed to accumulate usage history, preferences, and error notes over time, it expands the skill's data collection scope beyond its stated purpose and creates an unnecessary persistence and privacy risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code records arbitrary capability usage, failures, notes, recurring errors, and preferences to disk for any supplied skill directory, including under ~/.workbuddy/skills. Free-form notes and preference values can easily contain sensitive user or operational data, and the cross-skill design makes the collection broader than justified by this extraction skill's function.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents executable scripts that read and write local files, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, this increases the chance the skill is granted broader filesystem access than users expect, enabling unintended reads/writes when processing model outputs or schema files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description forces a specific language presentation for users, which can violate language/locale policy when no opt-in or alternative is provided. Nothing in the file indicates that the skill is intentionally limited to Chinese-speaking users or offers multilingual support.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The operational instructions and examples are presented only in Chinese, which imposes a language choice on users across the whole skill. The file does not document a justified region-specific constraint or provide any option for another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains the module docstring and CLI help text entirely in Chinese, which effectively forces one language for users of the skill. The policy allows locale constraints only when users are given a choice or the constraint is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module's natural-language interface, descriptions, and console messages are entirely in Chinese, with no indication that language is configurable or limited for a documented regional purpose. This creates a locale-policy concern because the skill effectively imposes a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The preference-recording path silently writes user-supplied keys and values to disk with no explicit warning, consent flow, or disclosure about retention. Even if intended for convenience, undisclosed persistence of preferences and notes can expose personal or business-sensitive information to later users, processes, or backups.
- Content
Static analysis
No suspicious patterns detected.