T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:511- Finding
Shell Command Injection Through User-Controlled Curriculum Topics
- Content
View full analysis
- Remediation
View remediation
Security audit
Curriculum Generator
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate curriculum-generation purpose, but it needs review because it can run unsafe shell searches from user-provided topics and persist sensitive education context locally.
Install only after reviewing and narrowing the shell search behavior, persistence defaults, and dependency controls. Treat curriculum topics as untrusted input, avoid entering student-identifying or sensitive disability/socioeconomic details unless storage is explicitly disabled or controlled, and confirm where generated files and memory records will be kept and how they can be deleted.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:38- Finding
Unpinned and Unverified Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:1356- Finding
Persistent Storage of Potentially Sensitive Conversation and Student Context
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims strict step enforcement and mandatory human escalation, but these later instructions prioritize completion and allow proceeding with placeholder resource states after timeout. That mismatch can cause the agent to bypass safety gates users and operators rely on, producing outputs that look complete despite unresolved failures.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section tells the agent that after a 3-minute timeout it should fill missing entries with 'MANUAL_RESEARCH_NEEDED' and proceed to CSV generation instead of stopping. That directly defeats the earlier mandatory escalation requirement and can create files containing unresolved or invalid resource data while implying successful completion.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document states 'Transparency > automation speed,' but other sections instruct immediate, no-pause execution and speed-first acceptance of whatever URL appears first. These contradictory instructions undermine predictable safety behavior and encourage the agent to optimize for throughput over verification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README states that the skill performs automatic web searches and stores memory/outputs locally, but it does not clearly warn users that prompts and generated curriculum data may be sent to external search tooling or persisted on disk. In an educational setting, this can expose sensitive operational details about students, teachers, or infrastructure and can also create files unexpectedly on the host system.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
In your chat with ClawdBot:
text Create a new curriculum for our PODWith Debug Mode
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The activation triggers are broad generic phrases such as 'create curriculum' and 'assess curriculum', which can cause the skill to activate during ordinary conversation without strong scoping or confirmation. Because this skill can perform searches and generate files, unintended activation increases the chance of accidental external queries, data storage, and workflow execution on incomplete or sensitive inputs.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Activation Triggers This skill activates when the user: - Says "create curriculum", "design curriculum", or "assess curriculum" - Says "curriculum help" or "start curriculum process" - Explicitly requests curriculum generation for a POD
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section says the agent must execute only one search per topic and not perform multiple searches. Later implementation examples and verification steps instruct the agent to run a second 'alternative' search when the first fails, so the operational logic conflicts with the stated rule.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Then:
text Create curriculum: - Python basics - 2 lessons - 1 week
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
- Resource Link: Search and populate with real URLs during curriculum generation
- Format: "URL1 | URL2 | URL3" if multiple resources
- Use web_search before writing Excel file
- If search fails, escalate (never write "TBD")
Mandatory Footer in Every Output
text - Resource Link: Search and populate with real URLs during curriculum generation
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs persistent storage of request context, user identity, decisions, escalations, and learnings in local files even though that retention is not necessary for basic curriculum generation. Unnecessary retention increases the chance of sensitive educational, operational, or personal data being exposed through later access, backup leakage, or cross-session reuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill persists curriculum request data and user details without clearly warning the user in the main description or activation flow. Users may disclose operational or personal information under the assumption of ephemeral processing, creating a consent and privacy transparency failure.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persisting full conversation context and user inputs in local memory files creates a natural-language data retention surface that may include sensitive names, roles, operational constraints, and educational context. Such stored transcripts can later be read, reused, or exposed outside the original interaction scope.
- Content
Static analysis
No suspicious patterns detected.