T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sync.py:31- Finding
Overlapping synchronization paths can cause source deletion or recursive directory growth
- Content
View full analysis
- Remediation
View remediation
Security audit
File Manager
Security checks for vulnerabilities and agentic risk
Overview
This file-management skill is mostly purpose-aligned, but it can delete or move local files and has under-documented destructive edge cases users should review before installing.
Install only if you are comfortable reviewing previews carefully and limiting use to test folders or explicit paths first. Do not run deduplicate.py without --scan-only unless you intend to delete or move files, avoid sync operations where source and target overlap, and do not use --no-confirm or scheduled --execute examples until you have verified the exact file effects.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/deduplicate.py:84- Finding
Deduplication deletion does not enforce the documented explicit execution gate
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description claims broad capabilities that are not actually implemented, including deduplication, batch renaming, synchronization, and size-based organization. This mismatch is dangerous because users or orchestration systems may trust the advertised behavior and authorize risky file actions under false assumptions, increasing the chance of misuse, unsafe routing, or execution of incomplete workflows.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/sync.py <source> <target> --mirror
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/sync.py <source> <target> --mirror
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/sync.py <source> <target> --mirror
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/sync.py <source> <target> --mirror
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python help='转换为大写') parser.add_argument('--execute', action='store_true', help='执行重命名 (默认仅预览)') parser.add_argument('--no-confirm', action='store_true', help='跳过确认') args = parser.parse_args()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises and demonstrates file-modifying operations such as organize, rename, deduplicate, and sync, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow broader-than-intended file write behavior and make dangerous operations harder to constrain or audit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description is very broad and can match many ordinary file-related requests, causing the skill to activate in contexts where file modification is unnecessary or unsafe. For a file-management skill with write/delete semantics, overbroad activation increases the risk of accidental invocation and unintended destructive operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
文件描述和标题均以中文表述该技能面向用户的交互方式，但未声明这是区域性工具，也未说明可根据用户偏好切换语言。根据语言/locale 政策，若技能隐含强制特定语言而无用户选择或正当说明，属于自然语言策略问题。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guidance '中文文件名（某些系统兼容性问题）' is natural-language advice that discourages Chinese filenames globally, effectively imposing a language/locale preference without user opt-in. The text does not limit this recommendation to specific environments or offer a contextual choice, so it conflicts with the policy against forcing a specific language or locale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The backup examples use
--mirror --execute, which can imply deletions or one-way synchronization effects, but the surrounding documentation does not warn users about the risk of overwriting or removing files. Because this is a markdown file, safety-affecting behaviors should be accompanied by a clear warning about impact to user data.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The scheduled command
organize.py ~/Downloads --by-type --execute --movewill automatically relocate files from the user's Downloads folder, but the markdown does not disclose the risk of unintended file moves or workflow disruption. This is a user-data-affecting automation and should include a warning before users adopt it.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring presents the tool only in Chinese, and the rest of the user-facing CLI help and status text follow the same pattern. This imposes a specific language on users without opt-in or justification, which matches the locale/language policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The argparse description, help text, examples, confirmation prompt, and runtime status messages are all hardcoded in Chinese. Because the file does not provide a user language choice or document a justified region-specific constraint, this is a natural-language policy issue.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 65% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python help='转换为大写') parser.add_argument('--execute', action='store_true', help='执行重命名 (默认仅预览)') parser.add_argument('--no-confirm', action='store_true', help='跳过确认') args = parser.parse_args()
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This is a natural-language policy issue because the skill presents its purpose and operation exclusively in Chinese, with no opt-in or alternative locale. For a general-purpose file organization script, that effectively imposes a language choice on users rather than offering one.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These strings control how users understand potentially impactful file operations, but they are available only in one language. Because the script is not documented as region-specific and offers no locale selection, this violates the language/locale policy constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language text in the module docstring and CLI help/output that is only in Chinese. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains natural-language text only in Chinese (for example, the module docstring and function docstring), which can indicate a language/locale constraint without any user choice or documented regional justification. The policy for this review flags language or locale restrictions when the skill does not explicitly offer opt-in or explain why a fixed language is required.
- Content
Static analysis
No suspicious patterns detected.