T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/init_skill.py:207- Finding
Unvalidated Skill Name Allows Output-Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
wangkang-skill-c
Security checks for vulnerabilities and agentic risk
Overview
This skill is broadly coherent for creating skills, but its packaging helper can accidentally include files outside the skill directory through symlinks.
Use this only on skill directories you control. Before packaging, check for symlinks and unexpected files, and avoid running the initializer with untrusted skill names or output paths. The behavior does not look deceptive or malicious, but the helper scripts need containment fixes before they are safe for routine use on untrusted inputs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package_skill.py:70- Finding
Skill Packaging Dereferences Symlinks and Can Disclose External Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose does not fully reflect that the skill acts like an operational CLI workflow over local directories and imposes concrete validation and packaging behavior. That hidden capability increases the risk of over-broad invocation and unintended changes to the local workspace.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose does not fully reflect that the skill acts like an operational CLI workflow over local directories and imposes concrete validation and packaging behavior. That hidden capability increases the risk of over-broad invocation and unintended changes to the local workspace.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md 1. Understand the skill with concrete examples 2. Plan reusable skill contents (scripts, references, assets) 3. Initialize the skill (run init_skill.py) 4. Edit the skill (implement resources and write SKILL.md) 5. Package the skill (run package_skill.py) 6. Iterate based on real usage
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them. #### Update SKILL.md **Writing Guidelines:** Always use imperative/infinitive form.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python # Print next steps print(f"\n✅ Skill '{skill_name}' initialized successfully at {skill_dir}") print("\nNext steps:") print("1. Edit SKILL.md to complete the TODO items and update the description") print("2. Customize or delete the example files in scripts/, references/, and assets/") print("3. Run the validator when ready to check the skill structure")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill instructs the agent to run local scripts, create directories, edit files, and package archives, which implies shell, file read, and file write capabilities, yet the skill declares no explicit tool scope. This is dangerous because a broadly-triggered skill can cause an agent to exercise more authority than the metadata communicates, reducing reviewability and increasing the chance of unintended filesystem actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation condition is extremely broad: any request to create or update a skill may trigger this skill. Because the skill includes instructions to create, edit, delete, validate, and package files, broad triggering raises the chance that it activates in situations where the user wanted discussion or planning rather than workspace modification.
- Content