T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:417- Finding
Unrestricted Transmission of Local File Content to a Configurable External Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
流程架构师
Security checks for vulnerabilities and agentic risk
Overview
This workflow skill is not deceptive, but it gives broad live-automation guidance for reading files, running scripts, calling APIs, and publishing content without enough scoping or confirmation controls.
Install only if you are comfortable reviewing each workflow before live execution. Keep runs in dry-run/mock mode by default, restrict readable files to approved project folders, allowlist external API destinations, use least-privilege tokens from environment variables, and require explicit confirmation before posting, writing, moving, ordering, billing, emailing, or otherwise changing external systems.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:253- Finding
Non-Atomic Idempotency Check Permits Duplicate Side Effects
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger keyword list includes broad, common terms such as workflow-building and triggers, which can cause the skill to activate in benign conversations that are not asking to execute automation. In this skill context, accidental activation is more dangerous because the skill advertises execution capability via read/exec and discusses file writes, HTTP requests, and workflow execution, increasing the chance of unintended operational guidance or actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill clearly enables file writes, external requests, and workflow execution, but it lacks a single, prominent safety section warning users about side effects, credential use, external API calls, data modification, and the need for confirmation before live execution. In this context, the absence of centralized risk guidance is more serious because the skill explicitly supports exec, provides executable Python snippets, and encourages moving from dry-run to production execution.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
L082 在 DSL 示例中直接将时区设为“Asia/Shanghai”，后续模板和陷阱说明中也重复默认使用该时区。文档未说明这是仅适用于特定地区的示例，也未提示用户根据自身 locale 选择时区，因此构成未经用户选择的语言/地区策略约束。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 62% confidence
- Finding
该技能全文以中文命名和说明为主，且未声明可根据用户偏好切换输出语言或本地化格式。虽然这未必是严格限制，但在缺少用户语言选择说明的情况下，存在默认强制特定语言/locale 的倾向。
- Content
Static analysis
No suspicious patterns detected.