T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:54- Finding
Secret-scanning commands expose complete credential values in command output
- Content
View full analysis
- Remediation
View remediation
Security audit
代码质量检查基础版
Security checks for vulnerabilities and agentic risk
Overview
This code-quality skill is mostly purpose-aligned, but it includes unsafe local commands that can expose secrets and overwrite a repository pre-commit hook.
Review this skill carefully before installing. Use it only on repositories where local command execution is acceptable, avoid running the documented secret scans unless output is redacted, and do not apply the pre-commit hook snippet without rewriting it to preserve existing hooks and validate the command logic.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:200- Finding
Malformed pre-commit installation overwrites an existing hook and disrupts repository commits
- Content
View full analysis
.git/hooks/pre-commit << 'EOF' #!/bin/bash echo "运行代码质量检查..." --include="*.js" --include="*.py" if [ $? -eq 0 ]; then echo "发现硬编码密钥,请修复后再提交" exit 1 fi echo "检查通过" EOF chmod +x .git/hooks/pre-commit ``` ### Technical Analysis The redirection operator overwrites `.git/hooks/pre-commit` without checking whether a hook already exists or preserving its contents. This can remove unrelated security, testing, or policy controls previously installed in the repository. The generated hook is also malformed. The line beginning with `--include` lacks an executable command, so the shell attempts to execute `--include=*.js` as a command. The following condition evaluates that invalid command's exit status as if it represented a successful secret match. Because the invalid command normally returns a nonzero status, the hook can incorrectly report success instead of performing the intended security check. Behavior can vary if the environment unexpectedly resolves a command with that name. The modification persists within the repository until the hook is repaired or removed. Although this is not demonstrated to be a malicious cross-system persistence mechanism, it is an unsafe persistent development-environment change. ### Attack Path 1. A user follows the documented recommendation in a Git repository. 2. Shell redirection replaces any existing `.git/hooks/pre-commit` file. 3. The new file is marked executable. 4. On a later commit, the shell attempts to execute the malformed `--include` line. 5. The intended credential scan does not run, and the condition interprets the unrelated failure status. 6. Existing hook protections are lost, while users receive unreliable security results or experience commit-workflow disruption. ### Impact Ass ...[truncated 516 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description is extremely broad, covering general code generation, debugging, testing, and deployment contexts rather than a narrowly scoped quality check. Overbroad activation increases the chance that the skill is invoked in situations where its exec-based behavior is unnecessary, exposing repositories and local environments to avoidable command execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description explicitly states '支持中文交互', presenting the skill as Chinese-language oriented without offering language selection or opt-in. Under the policy criteria, forcing or implicitly constraining language/locale without user choice is a natural-language policy concern unless justified as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example invocation is generic enough to match many normal development requests and does not limit operation scope or clarify whether commands will be run. In an agent setting, vague triggers can cause unintended skill selection and execution against the current project without sufficiently informed user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest frames the skill as a checking/reporting tool, but the body instructs the agent to generate fixes and create repository files such as configuration and hook scripts. That mismatch can lead to unintended repository modification by a user who expected read-only analysis, increasing the risk of persistence, workflow tampering, or accidental code changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that the agent can automatically generate repair patches after analysis, but it does not present a clear warning that this may alter repository files. In a tool-enabled agent, undocumented modification capability is dangerous because users may expect a report-only workflow while the skill transitions into code changes with security or operational consequences.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document says checks run locally and no extra API key is needed, yet elsewhere it references API integration and network-dependent operation. Contradictory security statements undermine informed consent and make it difficult for users to assess where code or metadata may flow, which is a trust and policy risk in agent environments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is presented as a local code-quality checker, but the documentation expands its behavior to API integration and network-dependent operation. This creates scope ambiguity that can cause an agent or user to permit broader actions than expected, including outbound communication or handling external data paths that were not part of the declared trust model.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises file processing including write operations, but there is no user-facing warning about repository modification risk or persistence changes. In context, this is more dangerous because the skill also has exec access, making it easier to combine analysis with silent creation or alteration of local project files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Claiming external API integration for a simple local code-quality skill broadens the apparent capability surface without justification. Even if no API calls are implemented here, the claim normalizes unnecessary external connectivity and may cause downstream agents or users to accept riskier behavior than the skill's purpose requires.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The highlighted core-functionality line repeats that the skill provides '中文交互', again implying a fixed language mode rather than a user-selectable preference. Because no alternative language path is documented nearby, this may violate the language/locale policy guidance.
- Content
Static analysis
No suspicious patterns detected.