T09 · Insecure Skill Coding Practices
Warning
- Location
docker-compose.yml:42- Finding
Docker configuration does not enforce the declared outbound domain allowlist
- Content
View full analysis
- Remediation
View remediation
Security audit
Literature Reviewer Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill’s literature-review purpose is coherent, but its installation and isolation guidance understates real browser, network, and local-file risks.
Review carefully before installing. Use a dedicated browser profile or container without unrelated logged-in accounts, do not rely on the provided Docker Compose file for domain allowlisting, avoid chmod 777, and prefer a manually reviewed, pinned release instead of asking an AI assistant to auto-clone into your skills directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SECURITY.md:137- Finding
Security documentation recommends world-writable session and output directories
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (42)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
- 限制权限
bash # 设置只读权限（除 sessions 和 output 目录外） chmod -R 755 literature-reviewer-skill/ mkdir -p literature-reviewer-skill/sessions mkdir -p literature-reviewer-skill/output chmod 777 literature-reviewer-skill/sessions
- 限制权限
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个完整的文献检索与综述生成技能，核心能力包括按主题搜索中英文文献、通过浏览器自动化从多个学术数据库获取信息，并产出含引文、标题、摘要的 Markdown 文档。而实际代码片段只是一个本地引用格式化工具：它接收已存在的文献字典，格式化作者和期刊引文，并生成简单 Markdown 参考文献列表。这属于声明中“输出 GB/T 7714-2015 引文”的一个很小的辅助子功能，但远不足以代表声明的主要用途。因此描述与代码行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个完整的文献回顾/检索型技能，核心能力应包括：按主题搜索中英文数据库、自动抓取文献信息、组织综述结果并生成特定格式输出。而实际代码块只是工作流中的一个辅助数据处理步骤——对已有论文记录进行去重。该代码既没有网络/浏览器访问，也没有任何与数据库检索、主题分析、摘要整理、参考文献格式化或 Markdown 导出相关的实现。因此，代码的实际主用途与声明的主要用途存在明显且实质性的偏差，应判定为不匹配。
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md Returns: SurveyResult: 调研结果 """ # Phase 0: Session Log session = await self._phase_0_session_log(query, config) try:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md | 代码 | 含义 | 使用场景 | |------|------|---------| | SU | 主题 | 广泛检索（推荐） | | TI | 篇名 | 精确匹配标题 | | KY | 关键词 | 主题相关 | | TKA | 篇关摘 | 篇名+关键词+摘要（最全面） |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md | 代码 | 含义 | 使用场景 | |------|------|---------| | SU | 主题 | 广泛检索（推荐） | | TI | 篇名 | 精确匹配标题 | | KY | 关键词 | 主题相关 | | TKA | 篇关摘 | 篇名+关键词+摘要（最全面） |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md | 代码 | 含义 | 使用场景 | |------|------|---------| | SU | 主题 | 广泛检索（推荐） | | TI | 篇名 | 精确匹配标题 | | KY | 关键词 | 主题相关 | | TKA | 篇关摘 | 篇名+关键词+摘要（最全面） |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md | 代码 | 含义 | 使用场景 | |------|------|---------| | SU | 主题 | 广泛检索（推荐） | | TI | 篇名 | 精确匹配标题 | | KY | 关键词 | 主题相关 | | TKA | 篇关摘 | 篇名+关键词+摘要（最全面） |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file explicitly states '注释语言 - 中文注释', which is a natural-language policy constraint requiring a single language. Under the policy, forcing a specific language without offering user choice or providing a clear region-specific justification is a violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly encourages users to have an AI assistant clone and install the skill automatically, while later warning them not to let AI auto-execute installation commands. That contradiction can normalize unsafe supply-chain behavior, causing users to grant a high-privilege agent permission to fetch and install unreviewed code into a trusted skills directory.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 1. 在隔离目录下载并审查代码 mkdir -p ~/test-skills cd ~/test-skills git clone --depth 1 https://github.com/stephenlzc/AI-Powered-Literature-Review-Skills.git
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file presents all safety instructions and warnings exclusively in Chinese, which can amount to a language-policy issue when users are not given an opt-in or alternative locale. The document does not state that the skill is China-specific or otherwise justify the single-language restriction.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The documentation instructs users to set the sessions directory to mode 777, making it world-writable. On multi-user systems or shared environments, other local users or processes could tamper with stored session data, inject malicious content, or read/modify outputs in ways that affect subsequent runs.
- Content
chmod -R 755 literature-reviewer-skill/ mkdir -p literature-reviewer-skill/sessions mkdir -p literature-reviewer-skill/output chmod 777 literature-reviewer-skill/sessions chmod 777 literature-reviewer-skill/output
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The documentation instructs users to set the output directory to mode 777, making generated files world-writable. This enables unauthorized modification or replacement of generated literature-review artifacts and could also facilitate symlink or file-clobbering issues in poorly isolated environments.
- Content
mkdir -p literature-reviewer-skill/sessions mkdir -p literature-reviewer-skill/output chmod 777 literature-reviewer-skill/sessions chmod 777 literature-reviewer-skill/output
text ---
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest frames the skill as conducting literature retrieval/review and outputting a Markdown document containing GB/T citations, titles, and abstracts. However, later sections define a much broader capability: generating a 3000-5000 word review draft, reviewing it against scoring criteria, revising it, and producing a submission-ready final article. That is a substantive expansion from survey collection/export into autonomous academic writing and evaluation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Mandating bilingual output and search behavior without user choice can expand the scope of external queries and collected material beyond what is necessary. While not severe by itself, it increases data processing and web activity in ways the user may not expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises convenient literature retrieval but does not warn users that it will perform automated browsing and persist raw results, logs, and analysis files. This undermines informed consent and can expose sensitive research topics, browsing-derived data, or retained records without the user's clear awareness.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Overly broad trigger phrases can cause the skill to activate on generic requests and initiate browsing, data collection, or file generation the user did not explicitly request. In this context, accidental invocation is more dangerous because the workflow includes automated web access and persistent storage of session artifacts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill specification is written in Chinese and the input schema explicitly centers Chinese fields such as
keywords_zh, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly defines a session/results/output directory structure and stores checkpoints, logs, citations, markdown outputs, and downloaded PDFs on local disk, but it does not require an upfront user confirmation or warning before persisting potentially sensitive research queries and retrieved content. In an agent environment, silent writes can expose private topics, accumulate untrusted files, and create integrity/privacy risks if users do not expect durable storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow enables automatic PDF downloading from external sources when config.download_pdfs is true, but it does not present an explicit warning that remote content will be fetched and saved locally. This is risky because downloaded documents are untrusted external files that may raise privacy, integrity, legal, or malware-scanning concerns, especially when retrieved automatically across multiple sources.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown skill is written as an instruction template entirely in Chinese and describes the agent's behavior and outputs in Chinese, but it does not state that language selection is optional or user-configurable. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill description and operating instructions are written in Chinese, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This manifest includes natural-language comments and runtime messages in Chinese, such as the startup banner and usage hints, with no indication that the skill supports other languages or that Chinese is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
yaml # 挂载目录 volumes: # 挂载 Skill 代码（只读，除 sessions 和 output 外） - ./SKILL.md:/app/skills/literature-reviewer-skill/SKILL.md:ro - ./AGENTS.md:/app/skills/literature-reviewer-skill/AGENTS.md:ro - ./README.md:/app/skills/literature-reviewer-skill/README.md:ro - ./SECURITY.md:/app/skills/literature-reviewer-skill/SECURITY.md:ro
Static analysis
Detected: suspicious.install_untrusted_source
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- mcp.json:135