T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/init_skill.py:196- Finding
Path Traversal Allows Skill Initialization Outside the Intended Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
displayname-wk
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate skill-authoring helper, but its helper scripts can read or write outside the intended skill folder in edge cases, so it should be reviewed before installation.
Install only if you trust the skill directories you will initialize or package. Avoid packaging untrusted skill folders, inspect for symlinks before packaging, and use simple hyphen-case skill names until the helper scripts validate paths and reject symlinks.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package_skill.py:69- Finding
Symlink Following During Packaging Can Disclose Local Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose describes an instructional or guidance-oriented skill for creating or updating skills. The actual code does not provide guidance content or creation assistance; instead, it implements a packaging tool that validates an existing skill directory and compresses it into a distributable .skill file. This is a materially different primary purpose. The filesystem reads/writes and archive creation are consistent with packaging behavior but are not reflected in the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents this as a guide for creating effective skills, implying instructional or workflow assistance for authoring/updating skills. The supplied code instead implements a minimal validation utility: it reads a specified skill directory, checks for SKILL.md, parses YAML frontmatter, enforces allowed properties and required fields, and validates naming/description constraints. This is a materially different primary purpose. While validation could be a supporting part of skill creation, the code chunk itself is specifically a validator rather than a guide, so the description does not accurately represent the actual behavior.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md 1. Understand the skill with concrete examples 2. Plan reusable skill contents (scripts, references, assets) 3. Initialize the skill (run init_skill.py) 4. Edit the skill (implement resources and write SKILL.md) 5. Package the skill (run package_skill.py) 6. Iterate based on real usage
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them. #### Update SKILL.md **Writing Guidelines:** Always use imperative/infinitive form.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python # Print next steps print(f"\n✅ Skill '{skill_name}' initialized successfully at {skill_dir}") print("\nNext steps:") print("1. Edit SKILL.md to complete the TODO items and update the description") print("2. Customize or delete the example files in scripts/, references/, and assets/") print("3. Run the validator when ready to check the skill structure")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill should be used when users want to create a new skill or update an existing skill, which is a wide trigger scope without concrete boundaries or exclusions. It does not provide negative examples or tighter constraints, increasing the chance of unintended invocation for generic conversations about skills.
- Content
Static analysis
No suspicious patterns detected.