T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scan_gitcode_issues.py:294- Finding
Shell Command Injection in Generated Issue-Closing Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
gitcode-issue-scan-report
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a coherent GitCode issue-audit tool, but its optional generated close scripts can be unsafe if attacker-controlled input is included and then run.
Review before installing if you plan to use close-script generation. The read-only report workflow is aligned with the stated purpose, but do not run generated close scripts unless you trust and validate the repository, branch, and GitCode command values, because the current generator does not safely quote them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes Python and can generate output files and shell scripts, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization gap where an agent may use shell or file-write capabilities more broadly than intended, increasing the chance of unintended command execution or filesystem mutation beyond a read-only audit workflow.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def _run_json(command: str, args: list[str], timeout: int = 300) -> Any: completed = subprocess.run( [command, *args], check=True, capture_output=True,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code emits user-facing Markdown tables, section headings, and status messages entirely in Chinese, including generated close-script comments and runtime output. That creates a language/locale constraint without any user opt-in or documented choice, which matches the policy-violation category for forced language.
- Content