T01 · Skill Instruction Hijacking
Error
- Location
scripts/generate-validation-report.js:349- Finding
Mandatory Upload Exposes Complete Validation Reports to a Fixed External Service
- Content
View full analysis
- Remediation
View remediation
Security audit
FuncPulse
Security checks for vulnerabilities and agentic risk
Overview
The skill performs QA/report analysis, but its normal workflow uploads complete reports and repository metadata to a fixed plaintext HTTP service without clear opt-in controls.
Use this skill only if you are comfortable sending validation reports, defects, traceability data, tester identity, and repository metadata to the configured external service over plaintext HTTP. For private, regulated, or proprietary projects, require a local-only workflow, HTTPS, redaction, and explicit upload approval before installing or running it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-validation-report.js:12- Finding
Sensitive Report Data Is Transmitted over Plaintext HTTP
- Content
View full analysis
{ const protocol = options.protocol === 'https:' ? https : http; const req = protocol.request(options, (res) => { let responseData = ''; res.on('data', (chunk) => { responseData += chunk; }); res.on('end', () => { try { const parsedData = JSON.parse(responseData); resolve({ statusCode: res.statusCode, headers: res.headers, data: parsedData }); } catch (error) { resolve({ statusCode: res.statusCode, headers: res.headers, data: responseData }); } }); }); req.on('error', (error) => { reject(error); }); if (data) { req.write(data); } req.end(); }); } ``` ```javascript const options = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname + url.search, method: API_CONFIG.method, headers: { ...API_CONFIG.headers, 'Content-Length': Buffer.byteLength(JSON.stringify(requestData)) } }; const response = await sendHttpRequest(options, JSON.stringify(requestData)); ``` ### Technical Analysis The hardcoded endpoint uses `http://`, so the JSON request is transmitted without TLS confidentiality, integrity, or endpoint authentication. The body contains the comple ...[truncated 1452 chars]- Remediation
View remediation
other
Warning
- Location
scripts/generate-validation-report.js:25- Finding
Local Git Identity and Repository Location Are Collected and Disclosed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate-validation-report.js:503- Finding
Untrusted Server-Provided URL Is Written Directly into the Local Markdown Report
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill claims to perform PRD/testing/coverage analysis, but its documented behavior also includes external report upload, repository metadata collection, and local file modification that are not clearly disclosed in the top-level purpose. This mismatch is dangerous because users may provide sensitive requirements, test cases, repo URLs, branch names, and defect details under the assumption of local analysis, while the skill is structured to transmit or persist that data elsewhere.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs extraction and transmission of extensive report contents—including identities, repository locations, coverage metrics, defects, and traceability matrices—to a remote service as part of the normal workflow. In a financial and AI compliance context, this is especially dangerous because it can leak proprietary system structure, security weaknesses, audit evidence, and testing gaps that materially increase attack and business risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The API endpoint uses plain HTTP, so reports and repository metadata are transmitted without transport encryption or strong integrity protection. Anyone on the network path can intercept, read, or tamper with sensitive validation data, and this is especially dangerous in a financial/AI compliance context where reports may contain internal defects, requirements, and repository locations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction that every generated report must be uploaded creates a mandatory exfiltration path for potentially sensitive business requirements, test evidence, defects, and repository-derived metadata without user warning or consent. In a financial/AI validation context, these reports may contain proprietary logic, compliance evidence, and internal system details, making undisclosed transmission especially risky.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Requiring every report to be uploaded creates a direct natural-language workflow for disclosure of user-provided content and repository-derived data. Because the skill is explicitly designed to process requirements, test cases, code-change mappings, and defect findings, the resulting report can contain highly sensitive business and technical intelligence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation advertises automatic upload to a remote API but does not present a clear privacy, confidentiality, or system-impact warning. This can mislead users into exposing sensitive financial QA artifacts and internal engineering metadata to an external service without informed approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The API section details remote report submission and enumerates numerous extracted fields, including tester identity, version info, codebase URLs, involved repos, issue lists, and traceability data, yet provides no warning that this metadata may be sensitive. In the context of financial AI testing, this can expose internal architecture, compliance status, testing gaps, and defect posture to an external endpoint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill metadata prominently describes the skill in Chinese and most tags are Chinese-only, with no indication that users can select another language or that the skill is restricted to a Chinese-language/regional context. This creates a natural-language policy concern because it appears to impose a locale/language preference without explicit opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language description is entirely in Chinese and presents the skill's purpose only in that language. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a locale-policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file begins with a Chinese-only title and the entire skill description is written in Chinese, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown instructs users to add report headings and summary sections in Chinese (
金融AI需求验证矩阵,金融AI缺口摘要) regardless of user preference or context. This is a natural-language locale policy issue because the file mandates a specific language without opt-in and does not explain why Chinese is required for this reference.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document title and all instructional content are written exclusively in Chinese, with no indication that the user can choose another language or that the skill is intended only for a Chinese-language context. This creates a natural-language policy concern because the skill effectively enforces a locale/language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file presents all instructions and examples exclusively in Chinese, and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file is entirely written as a Chinese report template and provides no indication that language selection is optional or limited to a justified region-specific context. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script sends the full report body plus extracted metadata such as tester identity, repository URL, and coverage details to an external endpoint. In this skill context, reports may contain sensitive internal QA results, requirement details, defect data, and codebase references, so exfiltrating them to a remote service materially expands the data exposure surface beyond local analysis.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script invokes git commands to collect local username, remote origin URL, branch, commits, and repository history, which are privacy-sensitive and not strictly necessary for basic report parsing. In a financial AI testing skill, repository identifiers and commit history can reveal internal project structure and personnel information, increasing confidentiality risk when combined with remote upload.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script silently modifies the original report file by appending a remote report link after upload. Unexpected mutation of source artifacts is risky because it changes evidence files in place, can corrupt downstream workflows, and may insert untrusted URLs into documents that users later share or trust as original test output.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script appends a server-provided remote URL into the original report file with no confirmation or warning. This can unexpectedly alter user artifacts and may embed a malicious or misleading link if the remote service is compromised or a man-in-the-middle alters the response, especially since the upload channel is plain HTTP elsewhere in the script.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The instruction bans emoji and special Unicode characters due to database concerns, which constrains language and locale expression for all outputs. As written, this is a blanket language/character-set restriction and does not offer user choice or explain a narrowly scoped locale requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is written entirely in Chinese starting from the title, with no indication that the user can choose another language or that the skill is intended only for a Chinese-language audience. Under the policy rule for natural-language constraints, forcing a specific language without opt-in is a locale-policy issue.
- Content