T09 · Insecure Skill Coding Practices
Note
- Location
- SKILL.md:11
- Finding
- Invisible Unicode Character Corrupts the Front-Matter Delimiter## Vulnerability Details **File Location**: `SKILL.md`, line 11 **Vulnerability Type**: Malformed configuration caused by an invisible Unicode control character **Risk Level**: Low ### Vulnerable Code ```yaml permissions: - binance.trading - binance.account.read --- ``` The delimiter on line 11 contains an invisible `U+200B ZERO WIDTH SPACE` before the three hyphens. Its effective representation is: ```text \u200B--- ``` ### Technical Analysis YAML front matter must normally be closed by a delimiter consisting of exactly three hyphens. The hidden character means line 11 is not byte-for-byte equivalent to `---`. Strict parsers may therefore treat the front matter as unterminated, while permissive parsers or preprocessing tools may remove or ignore the character and recognize the delimiter. This parser differential can cause validation and runtime components to interpret the same skill differently. In this package, the affected front matter declares sensitive Binance permissions: ```yaml permissions: - binance.trading - binance.account.read ``` No malicious executable payload or demonstrated privilege-escalation implementation was found. Nevertheless, invisible characters in security-relevant configuration syntax are unsafe because they can conceal malformed metadata from reviewers and produce inconsistent permission or loading behavior. ### Attack Path 1. A platform ingests `SKILL.md` and attempts to parse its YAML front matter. 2. A strict parser encounters the hidden `U+200B` character and does not recognize line 11 as the closing delimiter. 3. The platform rejects the skill, treats subsequent documentation as metadata, or produces an incomplete metadata representation. 4. If separate validation and runtime components normalize Unicode differently, one component may approve a different interpretation from the one used when loading the skill. 5. Depending on the host platform's erro ...[truncated 635 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `U+200B ZERO WIDTH SPACE` and replace line 11 with a plain ASCII delimiter: ```yaml --- ``` 2. Recreate the delimiter manually rather than copying the existing line, ensuring its byte sequence is exactly `2D 2D 2D`. 3. Add a CI validation step that rejects invisible or format-control Unicode characters in YAML delimiters, permission declarations, executable instructions, and other security-sensitive configuration. 4. Parse the front matter with the same parser and normalization rules during validation and runtime. 5. Fail closed when front matter is malformed; do not infer or grant permissions from partially parsed metadata. 6. Add a schema check confirming that the front matter closes correctly and that requested permissions are limited to the declared skill functionality.