T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/research_investors.py:264- Finding
Path Traversal Through Unvalidated Company Name in Default Output Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Investor Research
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent investor-research helper, but its bundled script can write reports outside the expected folder and overwrite writable files if given a crafted company name.
Before installing, treat generated investor reports as potentially sensitive fundraising material. If you run the bundled script, use an explicit safe --output path, avoid untrusted JSON input, and check for existing files because the default filename logic can overwrite writable markdown files outside the expected folder when company_name contains path components.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill instructs saving a report to the current working directory, which implies file-write capability, but it declares no explicit tool scope or permissions. Undeclared file access reduces transparency and can enable unintended reads/writes if the runtime grants broader capabilities than the user expects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill mandates presenting the information-gathering questions in Chinese, but does not indicate that this is optional or based on user preference. This creates a language/locale policy issue because the skill imposes a specific language without explicit user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill directs the agent to save output to a local file without clearly warning the user that a file will be created. Silent file creation can surprise users, overwrite existing work, or leave sensitive fundraising information stored on disk without explicit consent.
- Content
Static analysis
No suspicious patterns detected.