T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/safe-install.sh:104- Finding
Fabricated Skill Vetter Report Produces a False Safe Verdict
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Install Manager 1.0.0
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed because it claims to safely vet skill installs, but its bundled installer only prints a canned safe report and does not actually check the skill or configuration changes.
Install only after replacing the simulated vetting and configuration checks with real fail-closed checks. Treat the current script as a demo, not a safety control, and do not rely on its SAFE TO INSTALL output for untrusted skills or arbitrary sources.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/safe-install.sh:158- Finding
Configuration-Safety Check Unconditionally Approves Uninspected Skills
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill presents itself as a mandatory security gate for installations, but the described behavior does not provide any enforceable mechanism proving that vetting actually occurs or that configuration-changing installs are blocked. In a security-control skill, this mismatch is dangerous because users may rely on a false assurance boundary and proceed with unvetted or policy-violating installs.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script claims that every skill must pass a Skill Vetter review before installation, but the vetting function only prints a canned 'SAFE TO INSTALL' report and never validates the selected skill, its source, or its contents. This creates a false sense of security and can allow an untrusted or malicious skill to be approved and installed based solely on user confirmation.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The install path claims it checks for configuration changes and will refuse installation if modifications are required, but the code performs no such inspection and always reports success. In this skill's context, that is especially dangerous because the skill metadata explicitly promises rejection and reporting when config changes are needed, so operators may trust protections that do not actually exist.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documentation is entirely presented in Chinese, starting with the title, and nowhere indicates that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description is written entirely in Chinese and presents the skill behavior without any indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The markdown provides concrete installation and API invocation steps, including external requests and package installation, without warning users that queries, metadata, or credentials may be transmitted to third parties and that installation may have local side effects. This can lead to accidental data exposure or unintended system changes, especially because the skill is framed as a safety-oriented workflow.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill includes a curl command that sends data to an external service using an API key, which creates a real external transmission path. In context, this is more sensitive because the skill is marketed as a secure installation manager, so users may underestimate the privacy and credential-handling implications of transmitting search queries and related metadata off-box.
- Content
bash # 搜索"天气"相关技能 # 1. 先通过Composio搜索 curl -X POST "$COMPOSIO_BASE/tools/execute/COMPOSIO_SEARCH_TOOLS" \ -H "x-api-key: $COMPOSIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language comments and user-facing prompts are consistently in Chinese, and the comment at L004 explicitly states a requirement about how installations must be handled without any indication that language is configurable. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.