T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init-project.js:156- Finding
Unrestricted Project Path Allows Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
long-running-agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is not overtly malicious, but it needs review because it persists project state, can overwrite project files outside the intended area, and lets mutable project notes influence future agent work.
Install only if you want a Chinese-language workflow that stores project plans, progress, failed attempts, and session notes in local PROJECT.md and CHANGELOG.md files. Keep those files in trusted project directories, review them before asking an agent to continue work, and avoid untrusted project names or --path values because the init script can overwrite existing PROJECT.md and CHANGELOG.md files at writable destinations.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:70- Finding
Mutable Project Files Can Persistently Redirect Future Agent Sessions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
代码的实际功能非常有限，核心是“初始化新项目”。它会在指定路径创建项目目录，生成两个 Markdown 文件模板，并创建 tests 子目录。虽然模板内容中包含了‘Ralph Loop 状态’、‘失败的方法’、‘会话日志’等栏目，但这只是静态文本骨架，没有任何读取、恢复、更新、推进、分析或项目管理逻辑。声明描述的是一个完整的长时运行、跨会话项目编排系统，而提供的代码片段仅覆盖其中一小部分：创建新项目（且附带生成 PROJECT.md、CHANGELOG.md）。因此，该代码块的主要目的与声明的整体能力范围存在明显差异，属于实质性描述不符。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad enough to match ordinary conversation such as '继续工作' or '保存进度', which can cause the skill to activate unintentionally. In this skill's context, unintended activation is more dangerous because it can create or modify persistent project files and carry state across sessions without a clear, deliberate user action.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/list-projects.js
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly uses the filesystem as an 'external brain' and stores project context, progress, and failed attempts across sessions, but it does not prominently warn users that their content and work history will be persisted. This creates privacy and data-governance risk because users may disclose sensitive information assuming a normal ephemeral chat interaction.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The command reference maps ambiguous natural-language phrases directly to stateful behaviors without sufficient constraints, increasing the chance of accidental invocation. Because the skill is designed to persist work history and modify files, ambiguous routing can lead to unintended project creation, progress updates, or resumption of prior context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire template is written in Chinese and presents all headings and labels in a single mandated language, with no indication that other languages are allowed or that the user can opt in to this locale. Per the policy, a skill artifact that forces a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill reference is written in Chinese and does not provide any language-selection option or indicate that the locale restriction is intentional for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation and CLI output entirely in Chinese, including the script description and usage text, with no indication that the skill is region-specific or that users can opt into another language. Under the policy for natural-language violations, forcing a specific language without user choice is a reportable issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains all instructional content in Chinese, and nowhere indicates that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The template is entirely written in Chinese and presents all headings and instructions in that language, with no indication that users may choose another language. This can conflict with language or locale policy requirements when a skill should not force a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s natural-language interface is entirely in Chinese, including the header comments, usage instructions, option descriptions, and runtime error/help output. This imposes a specific language on all users without any opt-in or documented locale constraint, which matches the language/locale policy-violation category.
- Content