T09 · Insecure Skill Coding Practices
Warning
- Location
video_organizer.py:124- Finding
Unvalidated Rename and Backup Paths Allow File Moves Outside Approved Directories
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Organizer
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible video organizer, but it needs review because its file mutation and undo behavior are under-scoped and more risky than the documentation suggests.
Install only if you are comfortable running a local file organizer against directories you choose. Use preview, keep separate backups, avoid rename patterns or regex replacements containing slashes, dot-dot paths, or absolute paths, and do not rely on undo to remove organized copies. Do not run undo in a directory where .video-organizer-backup.json could have been modified by someone else.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented behavior does not match the actual behavior: it claims resolution-based organization and reliable undo, while the implementation reportedly lacks full support and does not correctly reverse organize/copy actions. This is dangerous because users may trust preview/undo semantics and perform bulk file operations that cannot be safely reverted, leading to data duplication, confusion, or partial data loss in managed media libraries.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The tool advertises undo support, but organize() copies files into the output tree while undo() only renames files from destination back to source. As a result, organized copies are not reliably reverted and users may believe a destructive or state-restoring undo exists when it does not, causing data inconsistency, duplicate files, and operational mistakes during file management.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file presents all user-facing instructions and operational guidance exclusively in Chinese. Under the stated policy, forcing a specific language without an explicit user choice or documented locale limitation is a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes operations that inherently read and modify files, but it does not declare any explicit tool scope or permissions. That creates a least-privilege and transparency problem: an agent or user may invoke a file-mutating skill without clear boundaries on what paths or file operations are authorized, increasing the chance of unintended filesystem access or destructive changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file uses Chinese for the description, headings, instructions, and warnings, but does not indicate that the skill is region-specific or provide any user opt-in for language preference. That can violate a language/locale policy when skills are expected to be usable without forcing a specific language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language strings that present the tool description only in Chinese. The policy explicitly calls out forced language or locale as a violation when the skill does not offer a language choice or clearly justify the constraint.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description says the tool supports organizing videos by '时间、格式、分辨率' (time, format, resolution). However, the implementation of folder selection only handles 'date' and 'format', and the CLI choices likewise expose only those two modes. This is a direct mismatch between the advertised capability and the implemented behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The preview, confirmation, cancellation, undo, and argparse help strings are all fixed to Chinese, which forces a locale for all users. There is no indication of user choice, opt-in, or documented region-specific restriction, so this matches the language policy violation category.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python if len(parts) >= 3: search = parts[1] replace = parts[2] return __import__('re').sub(search, replace, filename) return filename def undo(self):