T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:346- Finding
Path Traversal in Destructive Website Management Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
web-front
Security checks for vulnerabilities and agentic risk
Overview
This website generator is mostly coherent, but its delete and rename instructions could remove or move unintended files if a project name is unsafe.
Review this skill before installing if you expect it to manage existing files. It should only be used where generated websites live in a disposable or well-contained directory, and delete/rename operations should require exact path review and validated simple project names. Do not treat the included checkout page as production payment code.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (26)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <link rel="stylesheet" href="style.css"> </head> <body> <!-- 页面内容 --> <script src="script.js"></script> </body> </html>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <link rel="stylesheet" href="style.css"> </head> <body> <!-- 页面内容 --> <script src="script.js"></script> </body> </html>
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill includes a destructive shell deletion command using rm -rf for project removal, which is unnecessary for basic frontend generation. If project names or baseDir are malformed, user-influenced, or resolved incorrectly, this can cause irreversible deletion of unintended directories.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Embedding rm -rf with interpolated parameters is a classic tool-parameter abuse risk because a path derived from variables can delete far more than intended if validation fails. In skill context, this is especially dangerous because deletion is exposed through natural-language management commands rather than a tightly constrained admin interface.
- Content
删除命令：
bash # 删除整个项目目录 rm -rf "{baseDir}/html/{项目名}"安全确认：
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </style> </head> <body> <!-- 导航栏 --> <nav id="navbar"> <div class="nav-container"> <div class="nav-logo">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </style> </head> <body> <!-- 扫描线效果 --> <div class="scanline"></div> <!-- 网格背景 -->
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill states that it will automatically read and update files in the learning directory, but does not clearly warn users about these persistent local file operations. Hidden state changes can surprise users, create data integrity issues, and broaden the skill’s effective permissions beyond page generation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The learning triggers are vague and subjective, such as when the user wants something prettier or when trends change. This can lead the skill to read and update local learning files without clear user consent or a bounded condition, expanding its behavior unpredictably.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template hard-codes
<html lang="zh-CN">, which forces a specific language/locale regardless of user preference. The document does not offer a language choice or state that this skill is limited to Chinese-language websites only.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The single-file HTML template again hard-codes
<html lang="zh-CN">, imposing a fixed locale in generated output. Because no opt-in or locale selection mechanism is described, this is a natural-language policy violation.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase for website management is broad everyday language such as opening or viewing websites, which can activate actions unexpectedly. Ambiguous activation increases the chance of unintended scanning, file access, or browser-launch behavior from benign user conversation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s documented scope expands beyond frontend generation and preview into full lifecycle management operations such as deletion and renaming. This broadens the authority of the skill and increases the chance that users trigger filesystem-changing actions through ordinary language, creating avoidable risk outside the core purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill permits shell-based directory renaming via mv even though renaming is outside its core page-generation purpose. Without strict validation of old and new names, this can be abused to move or overwrite unintended paths within the filesystem scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document declares
lang="zh-CN"and the visible UI text is entirely in Simplified Chinese, which imposes a specific language/locale on users. There is no indication in the file that the skill offers language selection or that the locale restriction is required for a region-specific purpose.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The page tells users that their payment information is encrypted, but the code contains no actual transport, cryptographic, or payment-provider integration that would substantiate that claim. In a checkout skill that collects shipping details and can collect card data in the UI, this is a deceptive security assurance that may cause users to enter sensitive information under false assumptions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML root sets
lang="zh-CN", and the visible content is entirely Chinese, which imposes a specific language/locale on users. The file does not provide any user opt-in, alternate language selection, or documentation explaining that the page is intentionally region-specific.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill automatically launches a browser through system commands without prominently warning the user. While lower severity than filesystem deletion, it still creates an unexpected side effect and could be abused for nuisance behavior or to repeatedly spawn local processes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document declares
lang="zh-CN", and the visible UI labels and content are primarily in Chinese, with no indication that users can choose another language or that the page is intentionally restricted to a China-specific audience. Under the natural-language policy criteria, forcing a specific language/locale without user opt-in is a policy concern.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document declares
lang="zh-CN", and the visible navigation and primary content are presented in Chinese, which effectively fixes the experience to a specific locale. Under the policy, forcing a language or locale without user opt-in or a documented region-specific justification is a natural-language policy concern.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This file presents all instructional content in a single language, which can be a natural-language policy concern when users are not given an explicit language or locale option. There is no indication that the skill is intentionally region-specific or that Chinese is an opt-in choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire markdown file is written in Chinese and provides no indication that other languages are supported or that the language restriction is intentional for a region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all instructions and terminology exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally region-specific. Under the language/locale policy rule, forcing a specific language without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This file presents all headings, labels, and example UI text in a single language, which can constitute a language/locale policy issue when no user choice or opt-in is provided. The content does not indicate that the Chinese-only presentation is optional or justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is natural-language instructional content, and it forces a specific language for all users by presenting the entire skill in Chinese only. Under the policy rule, language constraints should either be optional for the user or clearly documented as justified for a specific locale or audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown content presents all instructions and checklist items exclusively in Chinese, with no opt-in, alternative language, or justification for a Chinese-only constraint.
- Content