T09 · Insecure Skill Coding Practices
Error
- Location
scripts/search_tool.py:215- Finding
Unbounded Archive Extraction and Legacy TAR Path Escape
- Content
View full analysis
- Remediation
View remediation
Security audit
Dir Text Search
Security checks for vulnerabilities and agentic risk
Overview
This local text-search skill is mostly purpose-aligned, but its archive extraction can create local safety risks when scanning untrusted archives.
Install only if you need recursive local text search and understand that matching content is saved to local result files. Avoid using it on untrusted archives or very large archive collections unless you run it in a restricted environment with storage limits, and prefer pinned dependencies in a virtual environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:74- Finding
Unpinned Third-Party Archive Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill title and operational instructions are presented in Chinese, but the file does not indicate that language is optional or user-selected. This can violate a language/locale policy when the skill implicitly forces one language without opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The phrase "任何需要在文件/压缩包中批量搜索字符串或正则的请求" is a broad catch-all that does not clearly bound when the skill should or should not activate. Without exclusions or negative examples, it could overlap with many general file-analysis requests and cause unintended invocation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md RAR 所需系统工具： - **Windows**：下载 unrar.exe → https://www.rarlab.com/rar_add.htm - **macOS**：`brew install unrar` - **Linux**：`sudo apt install unrar` 若用户未安装上述依赖，脚本会给出友好提示，ZIP/TAR 等格式不受影响仍可正常使用。
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python RAR 所需系统工具： - **Windows**：下载 unrar.exe → https://www.rarlab.com/rar_add.htm - **macOS**：`brew install unrar` - **Linux**：`sudo apt install unrar` 若用户未安装上述依赖，脚本会给出友好提示，ZIP/TAR 等格式不受影响仍可正常使用。
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python RAR 所需系统工具： - **Windows**：下载 unrar.exe → https://www.rarlab.com/rar_add.htm - **macOS**：`brew install unrar` - **Linux**：`sudo apt install unrar` 若用户未安装上述依赖，脚本会给出友好提示，ZIP/TAR 等格式不受影响仍可正常使用。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script advertises recursive search through logs, configs, and archives while also writing matching lines to a local result file, but does not prominently warn that matched contents may be stored persistently. Because the searched sources commonly contain credentials, tokens, personal data, or incident artifacts, this behavior can create a secondary sensitive-data repository.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
RAR handling relies on the external unrar utility via the rarfile library, introducing execution of a system binary that is not obvious from the skill description. This expands the attack surface because archive parsing is delegated to an external program, which may have its own vulnerabilities or unsafe behaviors when processing attacker-controlled archives.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The natural-language documentation and user-facing prompts are entirely in Chinese, and the script provides no language or locale choice. This creates a locale-policy issue because the skill imposes a specific language on all users without opt-in or documented regional justification.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The tool persists matched file contents to disk by default, which can unintentionally store sensitive data from searched files such as logs, configs, or secrets. In a directory-search skill, this increases data exposure beyond the immediate search task, especially if users do not expect content to be retained in a local results file.
- Content