T09 · Insecure Skill Coding Practices
Error
- Location
references/task_guidelines.md:73- Finding
Arbitrary Command Execution Through Sourcing JSON-Derived Shell Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Lightweight Knowledge Base
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a local knowledge-base tool, but it includes under-scoped persistent user-profile collection and an unsafe documented shell template that could execute modified JSON as code.
Install only if you want a Chinese-language local memory/profile tool and are comfortable with persistent profile files. Review or disable the automated/deep-dialogue tasks before use, avoid the documented source <(jq ...) template, and treat query commands without keywords as potentially exposing the full stored profile or task schedule on screen.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill description and the operational content are presented entirely in Chinese, with no indication that users may opt for another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly describes '每日进化' and automatic user-profile/knowledge-base optimization, which implies persistent modification of user data. Without an explicit warning, consent model, or confirmation boundary, users may not realize their profile and stored knowledge will be altered automatically, creating integrity and privacy risks through silent data mutation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This JSON file contains multiple human-readable descriptions entirely in Chinese, indicating a locale-specific language choice in the skill's metadata. Because the file provides no opt-in, alternative locale, or justification that the skill is intentionally region-specific, this appears to violate the language/locale policy for natural-language content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest uses Chinese-only natural-language labels and descriptions for user-facing scheduled tasks, which indicates a fixed language choice. There is no indication in this file that the user can choose a preferred language or that the locale restriction is explicitly justified.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The scheduled task explicitly instructs the system to collect user information through 'natural dialogue' and update a user profile, but the configuration shows no consent, scope limitation, minimization, retention, or review controls. In a memory-management skill, automated recurring profile enrichment can silently expand personal data collection beyond user expectations, creating privacy and compliance risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This JSON manifest defines broad execution flexibility such as time drift, generic skip conditions, and automatic recovery, but it does not clearly constrain when tasks should or should not run beyond a few high-level examples. The lack of specific trigger scope or negative examples makes automated invocation behavior ambiguous, especially for catch-up execution in the next cycle.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON profile embeds a Chinese locale and persona-specific language choices, including Chinese names, location set to China, and a role label written only in Chinese. Because SQP-3 applies to all file types, this is a natural-language policy concern when the skill behavior appears to force a specific language/locale without an explicit user choice or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document is entirely framed as a communication guide in Chinese and prescribes example responses and style norms without indicating that users may choose another language. This creates a natural-language locale policy issue because it appears to force a specific language/locale absent opt-in or a stated region-specific reason.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a lightweight knowledge base and task-management system built around structured JSON/Markdown storage and memory management. This guideline explicitly anticipates 'API 调用失败' and retry behavior, implying the skill may invoke external APIs, which is not an obvious or declared requirement for a local knowledge/memory store.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a lightweight knowledge base and task management system with '每日自动进化', implying meaningful maintenance or synthesis of stored knowledge. In practice, this script mostly touches JSON timestamps, counts markdown/JSON files, and echoes status messages; despite the '生成报告' section, no report file is actually written.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This shell script presents its title, status messages, errors, and usage guidance entirely in Chinese, which imposes a specific language on users. Under the policy, forcing a language without user opt-in or clear justification is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The function name and output text explicitly state that daily evolution is complete and direct the user to review generated reports in 'outputs/'. However, the function only prints console text and there are no file creation or write operations corresponding to a report, which is a direct contradiction between intent documentation and implementation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script's user-facing messages are entirely in Chinese and the generated default data hard-codes China-specific values such as "location": "中国" and "timezone": "UTC+8". There is no indication that the skill is region-specific or that the user can choose language/locale, which creates a natural-language locale policy issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
When no keyword is provided, the script prints the full contents of user_profile.json and task_rhythm.json directly to stdout. Although the script has basic usage text, it does not warn the user that running these commands may reveal complete personal or behavioral data on screen.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The initialization instructions direct the user to run a shell script that creates persistent files and directories, but the document does not clearly warn about those filesystem changes before execution. This can lead to unexpected writes in the environment, especially in agent contexts where users may assume a skill is informational rather than state-changing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing operational guidance exclusively in Chinese, and does not offer an alternative language or note that the skill is intended only for Chinese-speaking users. Under the language/locale policy check, forcing a single language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Comments and user-visible output such as the usage instructions are presented only in Chinese. This imposes a fixed language on all users without opt-in or explanation, which matches the language-policy violation criteria.
- Content
Static analysis
No suspicious patterns detected.