T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:248- Finding
Direct Modification of WorkBuddy's Internal Automation Database
- Content
View full analysis
- Remediation
View remediation
Security audit
Memo
Security checks for vulnerabilities and agentic risk
Overview
This memo skill is mostly coherent, but it needs review because it tells the agent to directly access WorkBuddy automation internals and allows unconstrained report file writes.
Install only if you are comfortable with this skill storing work notes locally, showing note contents in chat, creating or pausing WorkBuddy reminders, and potentially using direct database access for automation management. Prefer a version that removes the SQLite fallback, restricts exports to a dedicated folder, and asks before changing reminders or revealing large sets of saved notes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:515- Finding
Arbitrary Writable-File Overwrite Through Report Export Path
- Content
View full analysis
str: """ Generate a Markdown report and write it to a file. Args: start_date: Start date in 'yyyy-MM-dd' format end_date: End date in 'yyyy-MM-dd' format output_path: Output file path; when None, generate it under BASE_DIR Returns: Absolute output path """ records = self.filter_by_date(start_date, end_date) now = datetime.now() if not output_path: filename = f"工作记录导出_{now.strftime('%Y-%m-%d')}.md" output_path = os.path.join(BASE_DIR, filename) content = self._build_report_md(records, start_date, end_date, now) with open(output_path, 'w', encoding='utf-8') as f: f.write(content) return output_path ``` The CLI exposes the destination directly: ```python p_exp.add_argument('--out', '-o', default=None, help='输出文件路径') ``` ```python path = s.export_report(args.start, args.end, args.out) ``` ### Technical Analysis The report export function accepts a caller-controlled `output_path` and opens it in truncating write mode without validating or constraining the destination. Absolute paths and relative traversal components can therefore target any file writable by the current process. The function does not: - Restrict exports to a dedicated directory. - Canonicalize the destination and verify that it remains beneath an approved root. - Reject symbolic links. - Check whether the destination already exists. - Require confirmation before overwriting an existing file. - Use exclusive file creation. Because `open(output_path, 'w')` truncates an existing file before writing, selecting an existing w ...[truncated 1394 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `main.py` 提供以下函数，可直接调用：
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims persistence is limited to a local JSON memo file, but later instructs direct access to WorkBuddy's SQLite automation database. This is a scope and trust-boundary violation because it expands from note storage into modifying host application state in a way the user is not clearly told to expect.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A memo skill should not need raw access to the host's automation database to function. Granting or recommending direct SQL reads and writes to application internals enables unauthorized state changes, brittle behavior, and potential abuse beyond the skill's stated purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
整个 README 仅以中文描述技能能力、命令示例和操作说明，未见提供语言选项、用户自选机制，或声明这是面向特定中文地区/组织的限定技能。按规则，这可能构成语言/locale 强制要求而缺乏用户 opt-in。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L016 将技能触发表述为“直接说‘帮我记一下…’”，这是常见日常用语，缺少更明确的作用范围或排除条件。在 README 中也未看到负面示例或限定上下文，容易让代理把普通对话错误识别为技能调用。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documentation describes file read/write behavior and local persistence, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a governance gap: reviewers and runtime policy may not have a clear, enforceable boundary for what filesystem capabilities the skill is expected to use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description emphasizes automatic local persistence and later includes automation/database manipulation, but it does not give a clear user-facing warning about privacy implications or system changes. Users may disclose sensitive work information without understanding it will be stored long-term and may trigger host-side automation changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary conversation such as casual mentions of reminders, updates, or searching. That can cause the skill to activate unexpectedly and perform persistence or reminder-related side effects without the user clearly intending to invoke it.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Mandating that every write response echo full record content and IDs can expose sensitive work details in plain text, including names, plans, or confidential project information. This is especially risky in shared screens, logs, notifications, or chat histories where the echoed data persists beyond the original user input.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The query flow requires showing the full content of every matching record, which creates an easy bulk disclosure path for stored history. A broad query or ambiguous request could surface far more memorized information than the user expected, including sensitive historical notes.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
A global rule to always show concrete content for each record encourages routine re-disclosure of previously stored user data, regardless of context sensitivity. This increases the chance of accidental exposure through UI transcripts, screenshots, logs, or shoulder surfing.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Requiring a fixed or user working directory value for automation_update gives the skill influence over execution context outside simple note-taking. Even if intended for reminders, this exceeds the minimum capability boundary and can increase the blast radius of automation misuse or misconfiguration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The recommended fallback of directly editing the automation SQLite database modifies application state without a corresponding user warning or confirmation step. This makes hidden or poorly understood side effects more likely, especially when normal tool calls fail and the skill silently escalates to a lower-level mechanism.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The export_report method accepts an arbitrary output_path and writes user-controlled memo/report content directly to that filesystem location. In an agent skill context, this exceeds normal notebook functionality and can be abused to overwrite arbitrary local files accessible to the process, potentially corrupting application state, planting misleading content, or writing sensitive user data into unintended locations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The report export path is not constrained, and the method writes potentially sensitive user records to any path supplied without in-method warning or safety checks. In a local-memory skill, that creates a direct data exfiltration/misplacement and file-clobbering risk because an LLM or user prompt could cause confidential notes to be written into shared, synced, or application-critical locations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language rules, examples, and entity recognition logic are written entirely around Chinese phrases and Chinese-name patterns, but the file does not state that the skill is intended only for Chinese-language input or provide any user opt-in for locale/language behavior. This can violate language or locale policy if the skill is applied more broadly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file defines activation-like matching rules using very generic keywords such as "写", "安排", "检查", "研究", and "部署" without scope limits or exclusion examples. Because these terms appear frequently in ordinary conversation, the rules may unintentionally classify unrelated user input into specific work types.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L01-L03 state that reports must be generated strictly in the specified format, and the entire format is Chinese-language only. This imposes a fixed language/locale behavior without any opt-in, choice, or documented region-specific justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises local persistent storage and Markdown export but does not warn users that their inputs will be retained in a local JSON file or that files may be created on disk. This lack of transparency increases the risk of storing sensitive work content without informed consent and of generating artifacts that may be left accessible on the host system.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The example phrases are broad and conversational enough that an agent could invoke the note-taking skill during ordinary dialogue rather than from a clearly intentional save action. Because this skill performs persistent local storage, accidental activation can cause unintended retention of sensitive work details or creation of incorrect records without explicit user awareness.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The to-do viewing examples include very generic phrases like asking what remains undone, which can overlap with normal assistant conversation and trigger retrieval of stored tasks unintentionally. In a memory skill, accidental retrieval is risky because it may expose previously stored work information in contexts where the user did not intend to access it.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
L064-L068 仅给出“加载记事本技能”这一调用示例，但没有说明是否必须精确匹配、是否存在别名、以及哪些相近表达不应触发。对 manifest/说明类文件而言，这种缺少边界的调用描述会增加误调用或行为不一致风险。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest name and description are entirely Chinese, and the operational instructions throughout the file assume Chinese-language interaction. This can amount to a language/locale policy issue when no user opt-in or documented region-specific justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file-level description and user-facing CLI/help strings are entirely in Chinese, with no indication that another language can be selected. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation for get_automation_action_after_add states the action field will be one of 'create' | 'update' | 'none'. The implementation actually returns 'create_or_update', which actively contradicts the documented contract and can mislead an agent integrating with this method.
- Content
Static analysis
No suspicious patterns detected.