T09 · Insecure Skill Coding Practices
Warning
- Location
playbook.md:22- Finding
Sensitive Personal Identifier Passed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
한국 연금/노후 설계
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a coherent Korean pension-planning guide, but it includes unsafe guidance to pass a personal identifier through a shell command for a nonexistent pension lookup script.
Review before installing. The skill is not showing malicious behavior, but users should avoid entering resident registration numbers or similar personal identifiers into shell commands. Prefer official authenticated pension portals for exact estimates, and treat the skill's calculations as informational estimates rather than financial advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The beginner_alias entries include very generic Korean phrases such as '쉽게', '기초', and '모르겠어' that commonly appear in unrelated conversations. This can cause unintended routing into the pension skill, leading to context hijacking, irrelevant financial guidance, and accidental collection of retirement-related inputs from users who did not intend to invoke this domain.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The pension_guide trigger set contains broad phrases like '국민연금 가입' and especially short/common tokens in the same intent family that may activate on informational or ambiguous user statements without clear request intent. In a finance-oriented skill, overbroad activation increases the chance of misrouting users into regulated-adjacent advice flows and presenting guidance in the wrong context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s natural-language instructions, examples, and required disclaimer are all presented only in Korean. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file instructs behavior and examples exclusively in Korean, including mode names, triggers, and outputs, but does not indicate that Korean is optional or that the skill is intentionally restricted to Korean-language users. That can violate a language/locale policy when no user opt-in or explicit justification is provided.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Beginner Mode auto-switch uses very generic keywords like '쉽게', '처음인데', and '어려워', which can appear in ordinary conversation even when the user is asking for a specific pension calculation or routing target. This can cause misclassification into a simplified mode, degrading accuracy and potentially suppressing more appropriate handling or referrals, but it does not create a direct security compromise such as code execution or data exfiltration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown template forces a specific language/locale for all outputs, which can violate organizational language-choice policies when users are not given an opt-in or alternative. The file contains only Korean headings and response text, and no note explains that the skill is intentionally Korea-specific or that users may choose another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file is entirely written in Korean and presents source-tiering and citation instructions only in that language, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description and intent examples are predominantly in Korean and present the skill as a Korean-language experience, with no indication that users may opt into another language. This can violate language/locale policy when a skill implicitly requires a specific language without documenting that constraint or offering a choice.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Using 'IRP' alone as a trigger is overly broad because it is a short standalone acronym that may appear in other contexts, tools, or abbreviations. This can lead to accidental invocation of tax/pension comparison logic and delivery of financial recommendations when the user intended something else.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The standalone trigger 'TDF' is ambiguous and too short to reliably indicate retirement-portfolio intent. In this skill, that ambiguity matters because it can spuriously route users into investment allocation guidance or linked portfolio counseling without sufficient domain confirmation.
- Content
Static analysis
No suspicious patterns detected.