T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:723- Finding
Unsupported Git-Ignore Claim May Expose Cloud API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Soul Decision Engine
Security checks for vulnerabilities and agentic risk
Overview
This decision-support skill is not malicious, but it needs review because it handles sensitive decision records, cloud/team sync, rollback, and API key storage with weak scoping and security guidance.
Review this skill before installing in environments with confidential business, HR, client, or strategy data. Use cloud/team sync only with explicit user approval, avoid putting decision records or API keys into Git, store secrets in a real credential manager, and treat HR/personnel reports as advisory rather than authoritative.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
EOF
...
验证配置
ls -la ~/soul-decision/
text ### 300秒完整企业部署
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill promotes cloud sync and team-sharing of decision memory without a prominent, up-front warning that sensitive decision data may be transmitted to external services. In a skill handling business, HR, and strategic content, this omission increases the risk of accidental disclosure of confidential or personal information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Automatic snapshot creation, diffing, and restore operations can modify or revert stored decision data, yet the skill lacks a prominent warning about the risks of rollback and state mutation. In practice this can lead to accidental data loss, restoration of stale state, or unintended overwrites of decision history.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The error-handling guidance tells the agent to run
pingto test connectivity even when the primary problem is missing input parameters. That expands behavior into unrelated network activity, which can violate least-privilege expectations, leak environment/network metadata, or be abused as a pretext for outbound probing.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Line L041 states '永远不替你做决定' ('never makes decisions for you'), but later examples include generating manager decision-ability reports for HR and benchmark-style assessments that can materially influence personnel decisions. While not a direct code contradiction, the documentation's intent statement is in tension with later operational guidance that supports consequential evaluative use.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The phrase '完全中文化表达，适配中文用户工作流' indicates a language-localization constraint in natural language. The document does not also state that users may choose another language or locale, so this can conflict with policies against forcing a language without opt-in.
- Content