T09 · Insecure Skill Coding Practices
Error
- Location
scripts/step_executor.py:194- Finding
Path Traversal in Step Definitions Allows Arbitrary Local File Reads and Writes
- Content
View full analysis
- Remediation
View remediation
Security audit
小龙虾分层任务工作流
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible task workflow tool, but it needs Review because its execution and backup code can handle local files and remote backups without enough scoping or user control.
Review before installing. Keep backup, Git backup, email, and progress background reporting disabled unless you explicitly need them; use a non-sensitive test workspace first; do not run imported or untrusted project step files; and avoid configuring a remote Git repository until the package adds path containment, secret exclusions, destination allowlisting, and explicit confirmation prompts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup_manager.py:236- Finding
Git Backup Can Exfiltrate Sensitive Project Files to an Arbitrary Repository
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (60)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic recovery logic, smart retries, and the ability to modify execution configuration to enable real execution substantially increase operational risk compared with a planning-oriented workflow. A skill that can escalate from simulation to real actions, especially via config changes, may execute unintended side effects if the transition is not explicit and controlled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic recovery logic, smart retries, and the ability to modify execution configuration to enable real execution substantially increase operational risk compared with a planning-oriented workflow. A skill that can escalate from simulation to real actions, especially via config changes, may execute unintended side effects if the transition is not explicit and controlled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic recovery logic, smart retries, and the ability to modify execution configuration to enable real execution substantially increase operational risk compared with a planning-oriented workflow. A skill that can escalate from simulation to real actions, especially via config changes, may execute unintended side effects if the transition is not explicit and controlled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Automatic recovery logic, smart retries, and the ability to modify execution configuration to enable real execution substantially increase operational risk compared with a planning-oriented workflow. A skill that can escalate from simulation to real actions, especially via config changes, may execute unintended side effects if the transition is not explicit and controlled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Automatic recovery logic, smart retries, and the ability to modify execution configuration to enable real execution substantially increase operational risk compared with a planning-oriented workflow. A skill that can escalate from simulation to real actions, especially via config changes, may execute unintended side effects if the transition is not explicit and controlled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
Automatic recovery logic, smart retries, and the ability to modify execution configuration to enable real execution substantially increase operational risk compared with a planning-oriented workflow. A skill that can escalate from simulation to real actions, especially via config changes, may execute unintended side effects if the transition is not explicit and controlled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Automatic recovery logic, smart retries, and the ability to modify execution configuration to enable real execution substantially increase operational risk compared with a planning-oriented workflow. A skill that can escalate from simulation to real actions, especially via config changes, may execute unintended side effects if the transition is not explicit and controlled.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code can clone, commit, and push backups to an external Git repository, which gives the skill a durable off-host persistence and exfiltration mechanism. Because the skill's stated purpose is workflow/task decomposition rather than remote storage, this capability is unusually dangerous in context and could expose source code, logs, outputs, or secrets.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises code-driven behavior including filesystem access, shell usage, and possible network activity, but declares no explicit tool scope or permissions boundaries. In an agent environment, this can cause overbroad authority and make it harder for users or orchestrators to constrain risky operations before execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation mentions project creation, backup-related structures, and execution behavior, but does not prominently warn users about filesystem modifications or potential system impact. In an agent setting, insufficient notice undermines informed consent and can lead to unexpected writes, persistence, or state changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The auto-trigger rules use vague criteria like complex keywords, long estimated duration, or user request, which can cause the skill to activate in situations broader than intended. For a skill that can create files, run workflows, and potentially use shell/network capabilities, ambiguous triggering increases the chance of unreviewed side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest’s user-facing natural-language fields, including the skill name and multiple descriptions, are written entirely in Chinese with no indication that users can choose another language or that the skill is intended only for a Chinese-speaking region. This creates a language/locale policy concern because the skill presentation appears to enforce one language by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The configuration defines natural-language trigger/classification keywords only in Chinese, which can enforce a specific language behavior without any visible opt-in or justification. This creates a locale-policy concern because users operating in other languages may be subject to hidden language constraints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow includes API calling and API call logging without warning that task content, system context, or generated outputs may be sent to external services and recorded in logs. Because this workflow is designed to decompose and execute arbitrary user tasks, logged or transmitted content could include sensitive data, secrets, or proprietary information, increasing privacy and data-exposure risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow explicitly prescribes local and cloud backups but provides no notice, consent, data-classification rules, or exclusions for sensitive content. In a task-execution workflow that may process user inputs, generated documents, logs, and deliverables, this can cause unintended retention and third-party disclosure of confidential or regulated data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is described as a task decomposition/execution workflow, yet this file adds a subsystem for archiving entire project directories and state. That scope expansion increases access to data unrelated to the stated purpose and broadens the blast radius if the skill is used in sensitive environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and other user-facing text are entirely in Chinese, which imposes a specific language on users. Under the policy, language constraints should be optional or clearly justified as region-specific; this file provides neither.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring claims support for incremental backup, and
backup_projectacceptsbackup_typevalues includingincrementalandstate_only, but the method always generates a full manifest overproject_dir.rglob('*')and archives/copies all files regardless ofbackup_type. This is an active intent-code divergence because the documentation promises differentiated backup behavior that the code does not implement.- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python tmp_path = Path(tmpdir) # 克隆仓库 subprocess.run(['git', 'clone', git_repo, tmp_path], capture_output=True, check=True) # 切换到指定分支
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python capture_output=True, check=True) # 切换到指定分支 subprocess.run(['git', '-C', tmp_path, 'checkout', self.config['git_branch']], capture_output=True, check=True) # 复制项目文件到仓库
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ignore=shutil.ignore_patterns(*self.config['exclude_patterns'])) # 添加并提交 subprocess.run(['git', '-C', tmp_path, 'add', '.'], capture_output=True, check=True) commit_msg = f"备份: {project_dir.name} - {datetime.now().isoformat()}"
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python capture_output=True, check=True) commit_msg = f"备份: {project_dir.name} - {datetime.now().isoformat()}" subprocess.run(['git', '-C', tmp_path, 'commit', '-m', commit_msg], capture_output=True, check=True) # 推送
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 87% confidence
- Finding
This call pushes complete project backups to a configured remote repository, creating an external exfiltration path for potentially sensitive files, logs, outputs, and execution state. In the context of a task workflow skill, remote persistence is not clearly justified and materially increases the chance of unintended data disclosure.
- Content
python capture_output=True, check=True) # 推送 subprocess.run(['git', '-C', tmp_path, 'push', 'origin', self.config['git_branch']], capture_output=True, check=True) logger.info(f"Git备份成功: {git_repo}")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains natural-language strings and documentation that are exclusively in Chinese, including the module docstring and subsequent user-facing output. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file implements outbound email reporting and local persistence of report contents, which exceeds the skill's declared scope of task decomposition/execution. Scope expansion matters because it introduces data egress and retention behavior that users or integrators may not expect, increasing the chance of silent leakage of task content or metadata.
- Content
Static analysis
No suspicious patterns detected.