T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:16
- Finding
- Autonomous Publication of Generated Skills Without Adequate Security Review## Vulnerability Details **File Location**: `SKILL.md`, lines 16-24 **Vulnerability Type**: Unreviewed autonomous generation and external distribution **Risk Level**: Medium **Code Snippet**: ```text Every loop (every 6 hours): 1. Run self_learn.py → update market knowledge 2. Check demand_matrix.json → find high-opportunity skill gaps 3. Write a new SKILL.md → build the skill 4. Test it → run basic smoke tests 5. If valid → upload to zo.pub → post to freelance platforms 6. If skill earns < $X in Y weeks → deprecate and replace 7. Log everything to earnings_log.json ``` Related publication and shared-storage instructions appear at lines 45-51: ```text - Run `self_learn.py` first in every loop — never create skills without market data - Track which skills - List on ALL platforms simultaneously (CryptoGigs, FreeLanceDAO, x402) - Use `zopub sync` to publish to `https://zo.pub/ssyopros/skills` - Keep skills in `/home/workspace/Skills/` — that's where Zo agents find them - Log every created skill to `skills_registry.json` with a creation timestamp ``` ### Technical Analysis The documented workflow automatically creates new skills using market-derived data, performs only basic smoke tests, and then publishes successful outputs to zo.pub and multiple external marketplaces. It also places generated skills in `/home/workspace/Skills/`, which the document identifies as a location accessible to other Zo agents. Functional smoke testing does not establish that generated instructions or scripts are secure. The workflow does not require human approval, provenance validation, static security analysis, secret scanning, dependency review, permission analysis, or inspection for unsafe agent instructions before publication. Consequently, poisoned market input or unsafe generated content could pass functional testing while retaining harmful behavior. The referenced implementation files, including `skill_builder.py`, `t ...[truncated 1831 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit human approval before any generated skill is copied into shared agent directories or published externally. 2. Send generated artifacts to an isolated staging directory rather than directly to `/home/workspace/Skills/`. 3. Authenticate market-data sources and validate their schema, provenance, integrity, and expected value ranges before using them as generation input. 4. Treat all externally derived text as untrusted data and prevent it from altering builder or agent control instructions. 5. Add static analysis, secret scanning, dependency and source validation, dangerous-command detection, and permission review before publication. 6. Execute generated scripts in a sandbox with no production credentials, restricted filesystem access, limited network access, and strict resource limits. 7. Replace automatic publication to all platforms with per-platform opt-in approval and use staging or draft listings by default. 8. Produce an auditable manifest recording generated files, dependencies, requested capabilities, scan results, reviewer approval, and publication targets. 9. Add security-focused negative tests; functional smoke tests alone must not be treated as sufficient publication approval. 10. Implement rollback and revocation controls so an unsafe published skill can be promptly disabled and removed from every destination.