T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:115- Finding
Untrusted Remote Markdown Is Incorporated into the Agent Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
360-power-saver
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a power and battery utility, but it asks the agent to ingest remote Markdown and persist local diagnostic data without enough validation, scoping, or privacy controls.
Review this skill before installing. Use only if you are comfortable with local battery, CPU, memory, and process diagnostics, Windows powercfg reports, and administrator prompts for power-plan or energy-report operations. Avoid the cloud WebFetch feature unless the remote response is validated outside the agent workflow, and decline local persistence unless you understand exactly what diagnostic data will be stored and for how long.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:101- Finding
Documented Diagnostic-Data Anonymization and Persistence Controls Are Not Implemented
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (27)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about battery and power-management functionality, but the actual code performs string/file-name anonymization only. It does not inspect battery state, analyze power usage, generate battery reports, switch power plans, or optimize energy consumption. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a broader power-management tool with active optimization features such as one-click power saving, energy consumption diagnosis, and power plan switching. The supplied code does not perform any optimization or settings changes. It only retrieves battery information and shows it in a popup, which partially matches the 'battery health analysis' portion but not the broader declared functionality. There are no suspicious undeclared behaviors like exfiltration or unrelated access; the mismatch is that the implementation is much narrower than the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description promises active power-saving functionality and broader diagnostics, including one-click energy saving, battery health analysis, power plan switching, battery reports, and power optimization. The code does not perform those actions. It only collects basic system status via pmset, sysctl, and vm_stat, then displays a dialog with battery status, CPU info, approximate memory usage, and generic suggestions. While this is loosely related to power/battery awareness, the primary described capabilities are materially overstated relative to the actual behavior.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly forbids interfering with other processes, yet later advertises '智能后台冻结' that freezes inactive background processes. That contradiction weakens safety guarantees and could lead an agent to suspend applications or services, causing denial of service, data loss, or disruption of security tools.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The document states the skill must not read any user files from storage, yet multiple modules generate files in %TEMP% and battery/energy reports for later use or opening, including devicePreference.md and report outputs. This creates an intent mismatch because the skill necessarily handles stored files despite the absolute prohibition.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The safety section says network upload operations are strictly forbidden, yet the document also states the skill supports cloud machine learning and dataset download, and later instructs a WebFetch GET to a remote domain. While framed as read-only, this still contradicts the earlier categorical prohibition and creates mixed intent about whether network use is allowed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Cloud ML, remote dataset retrieval, and habit-learning materially expand the trust boundary beyond a local power-management tool. Even without explicit exfiltration in this file, these features normalize external dependency and behavioral profiling, increasing privacy and supply-chain risk if later implemented loosely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document assures users that no data collection occurs, then later requires appending anonymized execution results to local storage. Even local-only collection is still collection, and the contradiction can defeat informed consent around monitoring and retention of system-usage data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Per-user behavior learning and local persistence introduce profiling and retention that exceed what many users would expect from a battery optimization skill. Device/app usage patterns can become sensitive telemetry, especially when accumulated over time and used to infer habits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs local persistence of execution results in TEMP without a clear, prominent warning at the point of use. Because the stored outputs may include device state and app-usage characteristics, users may unknowingly permit retention of sensitive operational metadata.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Persisting analysis results and fetched context in TEMP creates a retention and leakage risk because those files may contain device characteristics, process-derived metadata, and optimization context. TEMP is often accessible to local users, backup tools, diagnostics, or other software, so sensitive metadata can spread beyond the immediate session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill directs the agent to contact an external domain and save returned content locally, but does not require a clear user-facing warning and consent flow for that network action. Silent external communication expands the attack surface and can expose the system to untrusted remote content or tracking expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Saving remote response content into a local file combines external content with local device-analysis workflow, creating provenance and retention risks. If the remote content is malformed, misleading, or unexpectedly sensitive, it can influence later decisions or remain on disk without the user's awareness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's user-facing title, prompts, warnings, and status messages are all in Chinese, which effectively forces a specific language on users. Under the policy rule, this is a natural-language locale violation because no opt-in, alternative language, or justification for a Chinese-only experience is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains user-facing headings, messages, and UI text entirely in Chinese, such as the title and status labels, but does not indicate that the skill is intended only for Chinese-speaking users or provide any language opt-in. This can violate language/locale policy because it forces a specific language experience without user choice or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user-facing comments, dialog text, and titles are entirely in Chinese, and the script provides no option to select another language or locale. This creates a language-policy concern because the skill imposes a specific language experience without explicit user opt-in or documented regional scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes capabilities such as one-click power saving, power-plan switching, battery health analysis, and energy diagnostics. In this file, the code only reads battery, CPU, and memory information and shows a dialog via osascript; it does not modify pmset settings, switch plans, or perform optimization actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's title, comments, dialog text, and recommendations are all presented only in Chinese, including the displayed macOS dialog. This imposes a specific language on users without offering a language choice or documenting that the skill is intended only for a Chinese-speaking or region-specific context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a battery/power optimization tool focused on省电, battery health analysis, energy diagnostics, power-plan switching, battery reports, and power consumption analysis. This file instead inspects RAM usage, enumerates top memory-consuming processes, and displays memory optimization advice, which is a distinct system-monitoring capability not clearly covered by the declared purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's natural-language title, status labels, recommendations, and message box content are entirely in Chinese, which imposes a specific language on users. The file does not provide any opt-in, fallback, or documented justification for this locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file’s user-facing title, description, and later UI strings are written in Chinese and present the skill as a Chinese-language experience by default. There is no indication that users can choose another language or opt in to this locale, which matches the policy concern for forced language/locale behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file presents its title, descriptions, and user-facing message box content entirely in Chinese, and does not offer any language selection or indicate that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when users are not given an opt-in or alternative locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's visible strings, title, prompts, and status messages are entirely in Chinese throughout the file. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The description string combines Chinese with Japanese text in a fixed way, without indicating that language is selectable or based on user preference. This can violate language/locale policy when a skill imposes a language presentation the user did not opt into.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file's human-readable comments are written only in Chinese, which imposes a specific language without offering an alternative or indicating that the skill is intentionally region-specific. Under the policy rule, language constraints should be optional or clearly justified.
- Content
Static analysis
No suspicious patterns detected.