T09 · Insecure Skill Coding Practices
Error
- Location
src/index.ts:406- Finding
Reports are generated from fixed sample content instead of the requested webpage
- Content
View full analysis
- Remediation
View remediation
Security audit
Geo Shield
Security checks for vulnerabilities and agentic risk
Overview
The skill is a review concern because it presents URL credibility reports while analyzing fixed sample text instead of the submitted webpage.
Review carefully before installing. This package shows no evidence of data theft or persistence, but it should not be relied on for real fact-checking or GEO-poisoning detection until it fetches and analyzes the actual submitted content, fixes domain validation, narrows activation triggers, and clearly labels heuristic limitations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/index.ts:121- Finding
Domain trust allowlist is bypassable through substring matching and incorrect URL handling
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The handler advertises GEO-poisoning detection for a user-provided URL, but it never fetches or analyzes the target page and instead scores a hardcoded sample article. This creates a deceptive security control: users may trust the report as applying to the supplied link, leading to false assurance, missed malicious content, and unsafe downstream decisions.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The handler presents itself as evaluating the user-supplied URL, but it never fetches or analyzes that page and instead scores a hardcoded sample article. This creates a deceptive security outcome: users may trust a report as if it reflects the target site, leading to false assurances or false accusations about real content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README presents all user-facing instructions, examples, commands context, support text, and operational guidance exclusively in Chinese, while only stating support for '中文 + 英文' content detection. There is no indication that users may choose their preferred interaction language, which can violate language/locale policy when a specific language is imposed without opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises natural-language triggers like “这个信息可信吗？https://example.com” and “检查可信度 https://example.com”, which are broad, conversational phrases that can easily appear in ordinary chat. In an agent environment, this raises the risk of unintended skill activation on user messages containing URLs, causing the skill to inspect or act on content when the user did not explicitly invoke it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language triggers are broad everyday phrases such as '这个信息可信吗？https://example.com', which can be matched during normal conversation rather than explicit user intent to invoke the skill. That increases the chance of accidental activation and unsolicited analysis of user-provided links or content, especially in multi-skill environments where routing is trigger-based.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill presents numeric credibility scores and risk labels with strong recommendation language, but does not prominently warn that these are heuristic signals with significant false positive and false negative risk, particularly for health, news, and academic use cases. Users may over-trust the output and make real-world decisions based on an unreliable classifier, causing misinformation acceptance or unjustified rejection of legitimate sources.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code embeds its title, functionality description, trigger phrases, help text, and generated report content entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not evident here.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests about verification, source checking, or information truthfulness, which can cause the skill to activate unintentionally. In a security-themed skill, accidental invocation is more concerning because it may intercept unrelated conversations, influence user trust decisions, or crowd out a more appropriate skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill’s name, description, trigger phrases, report output, and usage instructions are all written in Chinese, and the trigger matching logic is also centered on Chinese phrases. There is no natural-language indication that users may choose another language or that the locale restriction is intentional and justified, which can violate language/locale policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The package description is written entirely in Chinese, which indicates a language-specific presentation without any visible option for alternative locales or user choice in this file. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "author": "Spark", "license": "MIT", "devDependencies": { "@types/node": "^20.0.0", "typescript": "^5.0.0", "jest": "^29.0.0", "@types/jest": "^29.0.0",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "license": "MIT", "devDependencies": { "@types/node": "^20.0.0", "typescript": "^5.0.0", "jest": "^29.0.0", "@types/jest": "^29.0.0", "ts-jest": "^29.0.0"
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "devDependencies": { "@types/node": "^20.0.0", "typescript": "^5.0.0", "jest": "^29.0.0", "@types/jest": "^29.0.0", "ts-jest": "^29.0.0" }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "@types/node": "^20.0.0", "typescript": "^5.0.0", "jest": "^29.0.0", "@types/jest": "^29.0.0", "ts-jest": "^29.0.0" } }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "typescript": "^5.0.0", "jest": "^29.0.0", "@types/jest": "^29.0.0", "ts-jest": "^29.0.0" } }
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The description is entirely in Chinese, and the manifest does not indicate that language selection is optional or that the skill is intended only for a Chinese-language audience. This can conflict with language/locale policy expectations when no user opt-in or documented locale constraint is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This code file contains natural-language comments, test descriptions, and content examples exclusively in Chinese, which can reflect a language-specific assumption. Under the policy, forcing a specific language without opt-in or documented locale justification may be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.