T09 · Insecure Skill Coding Practices
Error
- Location
agent.json:42- Finding
Shell Command Injection Through Unsafely Interpolated Tool Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
GLM Multimodal Analyzer
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but its tool handler can turn user-supplied input into shell command execution and it uploads arbitrary local files to an external API without strong consent controls.
Review before installing. Use only with non-sensitive media or documents you are authorized to send to Zhipu/GLM, and do not pass untrusted filenames, URLs, or prompts through the current tool handler until the shell exec template is replaced with argument-array execution or equivalent escaping and validation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (16)
Tainted flow: 'headers' from os.environ.get (line 106, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def sync_response(headers, payload): """同步请求""" response = requests.post(API_URL, headers=headers, json=payload, timeout=120) if response.status_code != 200: print(f"API错误: {response.status_code}")
Tainted flow: 'headers' from os.environ.get (line 106, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def stream_response(headers, payload): """流式请求""" response = requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=120) if response.status_code != 200: print(f"API错误: {response.status_code}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README encourages users to submit local files, documents, images, and video URLs to a third-party multimodal model API, but it does not disclose that the content may be transmitted off-host to an external service. This creates a real privacy and data-handling risk because users may upload sensitive files under the mistaken assumption that processing is local or self-contained.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents use of an external API and an API key, which implies network access and environment variable usage, but it declares no explicit tool scope or permissions. This creates a transparency and governance gap: an agent or user may invoke capabilities that can exfiltrate data or access secrets without clear policy constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file presents key descriptive and usage content in Chinese, which can impose a language requirement on users without opt-in. Under the language/locale policy, this is a natural-language policy concern unless the skill explicitly offers language choice or explains a justified region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill encourages users to submit URLs and local file paths for image, video, and PDF analysis through a third-party API, but it does not warn that file contents, linked resources, or sensitive document data may be transmitted off-platform. In this context, that omission is dangerous because multimodal inputs often contain confidential information, and local-path support increases the risk of accidental external disclosure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This manifest file says the skill analyzes images, videos, and documents and instructs the agent to call the analyze tool 'when the user provides media files,' but it does not define specific invocation boundaries, exclusions, or negative examples. That ambiguity can cause unintended activation for common file-sharing contexts where the user may not actually want analysis.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language description and system prompt are written entirely in Chinese and instruct the assistant's behavior in that locale, with no indication that users can choose another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The tool explicitly accepts both file paths and URLs as input, but the manifest does not disclose that user-supplied local or remote content may be fetched and sent for analysis. This can lead to unintentional transmission of sensitive local files or remote resources, increasing privacy and data-handling risk in a multimodal analysis context.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script accepts arbitrary local file paths, base64-encodes the entire file, and sends the contents to an external API. In a skill context, this creates a real data exfiltration risk because users may analyze sensitive local documents or images without adequate guardrails, path restrictions, or consent messaging.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This outbound request transmits user prompts and potentially embedded local file data to an external service. External transmission is core to the skill's function, but it is still security-relevant because sensitive local content may leave the host environment and be processed by a third party.
- Content
python def sync_response(headers, payload): """同步请求""" response = requests.post(API_URL, headers=headers, json=payload, timeout=120) if response.status_code != 200: print(f"API错误: {response.status_code}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The tool sends prompts and optionally full local file contents to an external multimodal API, but the UX does not provide a clear, unavoidable warning about third-party disclosure at execution time. This is dangerous because users may unintentionally upload confidential data, and the skill context increases risk since its purpose encourages analyzing local media and documents.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The streaming request has the same disclosure and exfiltration characteristics as the synchronous request: prompts and possibly local file contents are sent to an external provider. The skill context makes this meaningful because local multimedia/document analysis is encouraged, increasing the chance that confidential data is uploaded.
- Content
python def stream_response(headers, payload): """流式请求""" response = requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=120) if response.status_code != 200: print(f"API错误: {response.status_code}")
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions and all example prompts are presented only in Chinese, which can amount to a language policy constraint if users are not given a choice. There is no indication that the skill supports multiple languages or that Chinese is a justified region-specific requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language description is written entirely in Chinese and presents the skill purpose in a single fixed language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the stated policy, forcing a specific language without opt-in is a locale-policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Natural-language strings throughout the script, including usage examples, help text, and status/error messages, are exclusively in Chinese. This imposes a fixed language choice on users without offering an alternative or documenting that the tool is intentionally region- or language-specific.
- Content
Static analysis
No suspicious patterns detected.