T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:176- Finding
PowerShell environment validation exposes credential values
- Content
View full analysis
- Remediation
View remediation
Security audit
主动型 Agent 基础版
Security checks for vulnerabilities and agentic risk
Overview
The skill looks like a real proactive-agent memory helper, but it needs review because it combines broad agent authority with automatic persistence and unclear data-flow boundaries.
Review this skill before installing if you use sensitive projects or credentials. It is not clearly malicious, but users should avoid letting it automatically save secrets or raw conversations, should treat its memory files as untrusted notes rather than instructions, and should not run the PowerShell environment-check command unless values are redacted.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:139- Finding
Untrusted user content can be persisted into cross-session agent memory without validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Describing invocation as generic natural-language triggering without strict boundaries makes accidental activation more likely during ordinary conversation. In a skill with read/exec/write capabilities, ambiguous triggering can cause unintended actions or state changes from benign user text.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The WAL-style instruction directs the agent to write user-related information to SESSION-STATE.md before responding, but it does not clearly warn users that their input will be persisted or modified on disk. This can lead to silent retention of sensitive, proprietary, or personal data beyond the current interaction.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction to persist user-provided information before responding encourages automatic storage of raw conversational content, including corrections, preferences, decisions, and specific values. Without minimization, consent, or classification, this can retain secrets or sensitive personal/business information unnecessarily and expand the attack surface of local files.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example trigger phrase is broad and conversational, so normal user dialogue could be interpreted as a command to run the skill. Because the skill can write files and execute commands, this overlap raises the chance of unintended execution and side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The usage description says the agent may automatically call tools or APIs, but it does not clearly warn users that external services may be contacted during execution. This weakens informed consent and can expose prompts, files, or metadata to third parties unexpectedly.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The broad practice of recording key information immediately instead of relying on context promotes aggressive data retention without clear limits on scope, sensitivity, or duration. In a tool-enabled agent, that guidance can normalize overcollection of user data and increase exposure if local files are later accessed, synced, or leaked.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill claims that FREE-version data stays local and is not uploaded to the cloud, yet elsewhere it allows external API access and a callback_url for asynchronous notifications. This creates a misleading privacy/security guarantee that could cause users to provide sensitive data under false assumptions, increasing the risk of unintended disclosure.
- Content
Static analysis
No suspicious patterns detected.