T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:110- Finding
Encryption Passphrases Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
安全加密工具-免费版
Security checks for vulnerabilities and agentic risk
Overview
This skill is a file encryption helper, but its examples expose passphrases in command lines and recommend deleting originals without strong safeguards.
Review before installing. Use this only for explicit local encryption/decryption tasks, avoid putting real passphrases directly in command text, and do not allow automatic deletion of originals unless you have verified decryption and have a backup. Treat the broad security/compliance trigger wording as out of scope for this skill.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 加密文件 safe encrypt \ --input secrets.txt \ --output secrets.txt.encrypted \ --passphrase "your-strong-passphrase" # ...
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 加密文件 safe encrypt \ --input secrets.txt \ --output secrets.txt.encrypted \ --passphrase "your-strong-passphrase" # ...
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 加密文件 safe encrypt \ --input secrets.txt \ --output secrets.txt.encrypted \ --passphrase "your-strong-passphrase" # ...
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 加密文件 safe encrypt \ --input secrets.txt \ --output secrets.txt.encrypted \ --passphrase "your-strong-passphrase" # ...
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 加密文件 safe encrypt \ --input secrets.txt \ --output secrets.txt.encrypted \ --passphrase "your-strong-passphrase" # ...
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 加密文件 safe encrypt \ --input secrets.txt \ --output secrets.txt.encrypted \ --passphrase "your-strong-passphrase" # ...
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger condition includes unrelated uses such as security detection, compliance audit, and vulnerability scanning, even though the skill only performs file encryption/decryption. Overbroad invocation criteria can cause an agent to route unrelated sensitive tasks into a skill that has exec/write capabilities, increasing the risk of unintended command execution or file modification.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建测试文件 echo "这是敏感数据" > secret.txt # ... # 加密 safe encrypt \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建测试文件 echo "这是敏感数据" > secret.txt # ... # 加密 safe encrypt \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建测试文件 echo "这是敏感数据" > secret.txt # ... # 加密 safe encrypt \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建测试文件 echo "这是敏感数据" > secret.txt # ... # 加密 safe encrypt \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建测试文件 echo "这是敏感数据" > secret.txt # ... # 加密 safe encrypt \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建测试文件 echo "这是敏感数据" > secret.txt # ... # 加密 safe encrypt \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation advises secure deletion of the original file immediately after encryption, but does not prominently warn that deletion is irreversible and that encryption/decryption should be verified first. In an agent-executed context, users may lose their only readable copy if the password is mistyped, the output is corrupted, or the operation fails silently.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The best-practices section recommends deleting originals but does not pair that advice with a strong warning about irreversible data loss or require confirmation steps. This is risky because the skill is designed for automation and may encourage destructive post-processing without ensuring recovery is possible.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that no API key is needed, but also declares an LLM API as a required dependency. This inconsistency can mislead operators about trust boundaries, secret requirements, and where user data may be sent, increasing the chance of unintended external data exposure or insecure deployment assumptions.
- Content
Static analysis
No suspicious patterns detected.