T09 · Insecure Skill Coding Practices
Warning
- Location
references/report-template.md:38- Finding
Unredacted Log Samples May Expose Sensitive Data in Shared Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
SRE Log Analytics
Security checks for vulnerabilities and agentic risk
Overview
This log-analysis skill is mostly coherent, but it can handle sensitive log content and reproduce raw samples in reports without clear redaction, scoping, or sharing safeguards.
Review before installing. Use this skill only with explicit log paths and time ranges, avoid broad system-wide log access, redact secrets and personal data before report generation, and do not export or share reports to cloud documents unless you have checked the sanitized content and recipient permissions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README suggests activating this skill for broad phrases like 'check logs' or 'analyze system operation' without clearly constraining scope, permissions, or context. This can cause unintended invocation on ordinary requests, potentially exposing sensitive log data or triggering analysis/reporting in situations the user did not explicitly intend.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Chinese usage guidance also uses generic trigger phrases such as '检查日志' and '总结报错' without defining boundaries for what logs, what system, or what authorization is required. As with the English section, this increases the risk of accidental activation and unintended handling of potentially sensitive operational data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The English trigger conditions are very broad phrases such as 'check logs' and 'analyze system operation', which are likely to match many routine user requests. In an agent environment, overly generic activation criteria can cause unintended skill invocation, expanding access to log-related workflows and potentially exposing sensitive operational data or causing the agent to take actions the user did not explicitly request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Chinese trigger conditions are similarly overbroad, including common requests like '检查日志' and '分析系统运行情况' without constraints. Because the skill is bilingual, this increases the chance of accidental activation across more user inputs, which can route ordinary troubleshooting conversations into a log-accessing workflow without sufficient specificity or consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The template hard-codes all headings and footer text in both English and Chinese throughout the document. This imposes a specific language/locale format on every generated report without any visible user opt-in or justification that the skill is region-specific.
- Content
Static analysis
No suspicious patterns detected.