T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ftp_sync.py:65- Finding
Plaintext server credentials accepted and documented as command-line arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Ftp Sync
Security checks for vulnerabilities and agentic risk
Overview
The skill presents itself as an FTP/SFTP sync and backup tool, but the included script is mostly a placeholder while the documentation asks users to pass server credentials on the command line.
Review this before installing. Do not rely on it for backups or deployments in its current form, and do not paste real server passwords into the documented commands. If used at all, treat it as a nonfunctional demo until the documentation and implementation are aligned, credentials are handled safely, and remote sync behavior is tested.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
scripts/ftp_sync.py:43- Finding
Unpinned third-party dependency installation recommendation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims FTP/SFTP upload, download, diff, and incremental sync capabilities, but the analysis indicates those behaviors are not actually implemented and may be placeholders. This is dangerous because users may rely on it for administrative or backup tasks, assume files were synchronized, and make operational decisions based on false expectations, potentially causing data loss, missed backups, or unsafe server state.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough to match ordinary file synchronization or server-related requests without sufficient specificity, which can cause the agent to invoke this skill in contexts the user did not intend. In a tool that can modify remote files, unintended activation increases the risk of accidental overwrite, misuse of credentials, or execution of an incomplete or misleading workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes remote synchronization commands but does not warn users about overwrite, deletion, drift, credential exposure, or the need to verify destination paths before syncing. In a server-management context, missing safety warnings materially increases the chance of destructive operator error, especially because users may run examples as-is with privileged accounts like 'root'.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains user-facing natural language in Chinese in the module description, help text, and status messages, which indicates the skill is oriented to a single language. Under the policy, locale or language restrictions should not be imposed without user opt-in or clear justification, and none is provided here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises FTP/SFTP synchronization and incremental backup, but the implementation only lists local files and prints placeholder messages instead of performing any authenticated remote transfer. This is dangerous because users may rely on it for backups or server synchronization and falsely believe critical data has been transferred or protected when no such operation occurred.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All user-facing natural-language content, including description, headings, and usage guidance, is presented only in Chinese. There is no indication that the skill is region-specific or that users may opt into another language, which may violate language/locale policy requirements.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function docstring states that it synchronizes local files to a remote destination, but the code never establishes a network connection or transfers data. Misleading operational descriptions can cause administrators to trust a nonfunctional sync path, leading to missed deployments or absent backups.
- Content