T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:325- Finding
Command Injection Through Unquoted Watched File Path in Processing Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
Flowforge Builder Free
Security checks for vulnerabilities and agentic risk
Overview
This workflow-automation skill is purpose-aligned, but it teaches persistent scheduled execution, file-triggered command execution, and off-host data posting without enough safety scoping.
Install only if you are comfortable reviewing each workflow before running it. Keep watched directories private and narrowly scoped, avoid sending local file contents to external APIs unless intended, do not put untrusted filenames into shell commands, and use a dedicated low-privilege environment for cron or long-running workflows.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:388- Finding
Command Injection Through Unquoted Watched File Path in Formatting Workflow
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:429- Finding
Unpinned and Unverified Python Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "schedule": "0 */6 * * *" }, "steps": [ { "action": "fetch", "url": "https://api.example.com/data", "output": "rawData" }, { "action": "save", "path": "./output/data.json", "input": "rawData" } ], "errorHandling": {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "schedule": "0 */6 * * *" }, "steps": [ { "action": "fetch", "url": "https://api.example.com/data", "output": "rawData" }, { "action": "save", "path": "./output/data.json", "input": "rawData" } ], "errorHandling": {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "schedule": "0 */6 * * *" }, "steps": [ { "action": "fetch", "url": "https://api.example.com/data", "output": "rawData" }, { "action": "save", "path": "./output/data.json", "input": "rawData" } ], "errorHandling": {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "schedule": "0 */6 * * *" }, "steps": [ { "action": "fetch", "url": "https://api.example.com/data", "output": "rawData" }, { "action": "save", "path": "./output/data.json", "input": "rawData" } ], "errorHandling": {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "schedule": "0 */6 * * *" }, "steps": [ { "action": "fetch", "url": "https://api.example.com/data", "output": "rawData" }, { "action": "save", "path": "./output/data.json", "input": "rawData" } ], "errorHandling": {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "schedule": "0 */6 * * *" }, "steps": [ { "action": "fetch", "url": "https://api.example.com/data", "output": "rawData" }, { "action": "save", "path": "./output/data.json", "input": "rawData" } ], "errorHandling": {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "schedule": "0 */6 * * *" }, "steps": [ { "action": "fetch", "url": "https://api.example.com/data", "output": "rawData" }, { "action": "save", "path": "./output/data.json", "input": "rawData" } ], "errorHandling": {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly documents workflows that can write and move files, execute shell commands, perform network requests, and install scheduled persistence, but it does not warn users about the risks to local data, privacy, or host integrity. In an agent-executed skill, normalizing these side effects without consent or safety guardrails increases the chance of unintended destructive actions or silent data exfiltration.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The documentation instructs users to register the workflow as a cron job, establishing persistence on the host without discussing review, revocation, or unintended repeated execution. In combination with file, network, and exec capabilities, scheduled persistence increases the blast radius of a mistaken or unsafe workflow by causing recurring actions without further user intervention.
- Content
python runner.py --workflow workflows/fetch_data.json
注册为定时任务（Linux）
crontab -e
添加：0 */6 * * * python runner.py --workflow workflows/fetch_data.json
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This example reads a triggered local file and POSTs its contents to an external endpoint, creating a clear data exfiltration pattern in the documentation. In a workflow-builder skill that encourages automation, showing direct transmission of file contents without consent checks, sanitization, or warnings makes accidental leakage of sensitive files more likely.
- Content
md { "action": "read", "file": "${trigger.file}", "output": "fileContent" }, // 第二步：用fileContent作为输入 { "action": "fetch", "url": "https://api.example.com/process", "method": "POST", "body": "${fileContent}", "output": "result" }, // 第三步：用result作为输入 { "action": "save", "path": "./output/result.json", "input": "${result}" }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example shows a file watcher automatically reading newly created files, invoking a command with the triggered file path, and moving the file afterward, all without cautioning about accidental processing of sensitive or attacker-controlled files. In this context, automatic file-triggered execution can amplify mistakes and turn dropped files into command inputs or silent data handling events.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md { "trigger": { "type": "manual" }, "steps": [ { "action": "fetch", "url": "https://api.source1.com/data", "output": "data1" }, { "action": "fetch", "url": "https://api.source2.com/data", "output": "data2" }, { "action": "exec", "command": "python merge.py --source1 data1.json --source2 data2.json --output merged.json", "output": "mergeResult" }, { "action": "save", "path": "./output/merged.json", "input": "${mergeResult}" }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "trigger": { "type": "manual" }, "steps": [ { "action": "fetch", "url": "https://api.source1.com/data", "output": "data1" }, { "action": "fetch", "url": "https://api.source2.com/data", "output": "data2" }, { "action": "exec", "command": "python merge.py --source1 data1.json --source2 data2.json --output merged.json", "output": "mergeResult" }, { "action": "save", "path": "./output/merged.json", "input": "${mergeResult}" } ],
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file states '完全中文化工作流定义说明与参数文档', and the entire skill is presented only in Chinese with no opt-in, alternative locale, or justification that it is region-specific. Under SQP-3, forcing a specific language without user choice is a natural-language policy concern.
- Content