T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:256- Finding
User-Controlled Filenames Permit Path Traversal and File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
lecture-notes-master
Security checks for vulnerabilities and agentic risk
Overview
This skill is for creating Obsidian study notes, but it needs review because it can create or overwrite many local vault files and does not safely constrain output paths.
Review before installing. Use it only if you want English-Chinese Obsidian notes written into the configured vault, confirm the target folder and file tree before any run, avoid untrusted titles or concept names, keep backups, and prefer a dedicated sandbox/output folder. Install optional Python dependencies in an isolated, pinned environment, and treat URL/video extraction as external processing that may reveal the provided links or content.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:163- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
numpy== ``` 2. Generate and publish cryptographic hashes for all direct and transitive distributions, then require verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Document the expected trusted package index and avoid implicitly relying on arbitrary user-configured mirrors. 4. Install dependencies in an isolated virtual environment rather than the global Python environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Record and periodically review transitive dependencies. 6. Replace the runtime messages with instructions referencing the locked requirements file rather than recommending an unconstrained `pip install`. 7. Consider providing a reproducible container or packaged environment with reviewed dependency versions. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description overstates the implemented functionality. The code does generate Obsidian-compatible markdown scaffolds with wikilinks and bilingual glossary fields, so it is related in theme. However, it does not process the broad declared input modalities at all; it only uses CLI arguments. Its 'recursive atomic decomposition' is not implemented as automatic multi-layer generation—lecture mode generates only the main note and first-level atomic notes, while deeper layers require manual separate runs. Rich outputs like Mermaid diagrams and comparison tables are not synthesized by code, only left as TODO/template content. Additionally, the code supports generating a course MOC, an undeclared capability. Therefore the declared description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description centers on creating structured Obsidian lecture notes and recursively decomposed atomic notes from source materials. The supplied code does not perform note generation, decomposition, source ingestion, or Obsidian vault construction. Instead, it loads local CSV files and runs BM25-based search over glossary, Mermaid templates, writing rules, and review questions, then formats search results for display. While glossary and Mermaid-related content are tangentially related to the declared domain, the code’s actual primary purpose is search/retrieval of reference data, not lecture note generation. This is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full lecture-note generation system for Obsidian, centered on transforming source materials into richly structured markdown notes with diagrams, tables, glossary content, and wikilinks. In contrast, this code chunk only implements a visualization generator script. It accepts command-line arguments for chart type, title, JSON data, and output path, then renders and saves image files using Matplotlib. While charts could be a supporting component of a larger note-generation workflow, this specific code neither ingests the declared educational inputs nor produces the declared note outputs. Its primary purpose is materially different from the declared skill purpose, so this is a clear mismatch.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown example presents the skill being invoked and used in Chinese, and the rest of the examples consistently structure outputs with Chinese labels and bilingual Chinese-first formatting. Because the file does not indicate that language choice is optional or user-configurable, it suggests a fixed locale behavior that may violate language/locale policy expectations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill instructs file reads/writes into the user's Obsidian vault but does not declare an explicit tool scope such as allowed tools or permissions. In an agentic environment, undeclared filesystem capabilities reduce transparency and make it easier for a broadly triggered skill to modify local content unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match ordinary summarization or note-taking requests, increasing the chance the skill activates when the user did not intend large-scale vault modifications. Because the skill also prescribes directory creation, many file writes, and optional network fetching, overbroad activation materially raises the chance of unintended side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user profile hard-codes the language policy as "Bilingual — English primary, Chinese secondary" and mandates a specific term format. This forces a locale/language preference rather than offering the user a choice or making the behavior clearly optional.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs creation of directories and writing numerous files into the user's vault without an explicit user-facing warning or confirmation step. In context, this is risky because activation may be broad and the write pattern is recursive and high-volume, making accidental content sprawl or overwriting more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The rule explicitly requires all technical terms to be presented as English plus Chinese, regardless of user preference or locale. In a note-generation skill that accepts arbitrary user inputs and produces educational content, this creates a policy-level prompt injection/output steering issue: it can force unsolicited language transformation and disclosure of translated terminology that the user did not request. The skill context makes this more relevant because the CSV appears to define mandatory generation behavior across all notes, so the requirement is likely to be applied broadly and consistently.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code generates note content containing Chinese text such as '详见' and '关键要点' directly in the output scaffold. Because the skill does not present this as an opt-in language choice or justify it as a region-specific tool, it violates the policy against forcing a specific language/locale by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template hardcodes bilingual formatting in the title and throughout the document, requiring Chinese alongside English rather than letting the user choose a preferred language. This is a natural-language policy concern because it imposes a specific locale/language convention without visible opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The template repeatedly hardcodes Chinese labels such as 概述, 关键要点, 总结, and 相关笔记, establishing a fixed bilingual locale across the document. Because no user choice or scope limitation is provided, this can violate language/locale policy expectations for user-controlled output language.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The standalone trigger "Exam prep / study materials" is too vague to distinguish this skill from many other educational or summarization workflows. It lacks constraints about format, required outputs, or Obsidian-specific context, increasing the risk of unintended invocation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill directs the agent to fetch URLs, extract transcripts, and use external tools without disclosing that network requests and third-party processing may occur. This can expose user-provided links, study materials, or browsing intent to external services and may surprise users who expected local-only note generation.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
python Generates Obsidian-compatible markdown notes from templates. Usage: # Main lecture note with N concepts (not limited to 3) python3 generate.py --type lecture --title "Memory Optimization" \ --concepts "Shared Memory,Bank Conflicts,Tiling,Coalescing" \ --output "/path/to/00-Inbox/Topic/"
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
python Generates Obsidian-compatible markdown notes from templates. Usage: # Main lecture note with N concepts (not limited to 3) python3 generate.py --type lecture --title "Memory Optimization" \ --concepts "Shared Memory,Bank Conflicts,Tiling,Coalescing" \ --output "/path/to/00-Inbox/Topic/"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The docstring states 'Supports both English and Chinese queries,' which communicates an explicit language constraint. Under the policy rule, forcing a specific language set without user opt-in or a clear justification can be a natural-language locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The template consistently requires both English and Chinese fields and section headings, such as paired title aliases and bilingual headings throughout the document. This imposes a specific language/locale format by default rather than offering a user choice or documenting that the template is region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown explicitly states 'Language（语言） | English (Bilingual notes)', which imposes a specific language setting in the template. Under the policy rules, forcing a language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown template hardcodes Chinese punctuation and section labels such as '定义' and '相关笔记', and requires bilingual English/Chinese output. That imposes a specific language/locale convention in the generated content without indicating that the user can choose another language or opt in to this format.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md <!-- REPEAT for as many sections as the content demands. NOT limited to 3. Typically 3-7 sections. Each section corresponds to one L1 atomic note. -->
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md <!-- REPEAT for as many sections as the content demands. NOT limited to 3. Typically 3-7 sections. Each section corresponds to one L1 atomic note. -->
Static analysis
No suspicious patterns detected.