Back to skill

Security audit

Zero Cover Mode

Security checks for vulnerabilities and agentic risk

Overview

This bug-fix automation skill is broadly coherent, but it includes under-scoped command execution, future scheduling, dynamic imports, and cleanup behavior that users should review carefully before installing.

Install only if you are comfortable with a skill that writes workflow state into the workspace, runs project test commands, and may create future verification tasks. Review any generated cron instructions before enabling them, run it in a sandbox for untrusted repositories, and avoid using it where a bugs directory contains unrelated data.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T06 · System Persistence

Error
Location
lib/state_manager.py:560
Finding

Cross-session persistence through scheduled verification tasks

Content
View full analysis
"" # 输出格式: cron action=add schedule.kind=every everyMs= ... ``` ``` ```python def schedule_verification(bug_id, hours_list=None, path=None): """安排验证计划 — 带文件锁保护""" if hours_list is None: hours_list = [24, 168, 720] fp = path or locate() lock_held = _acquire_file_lock(fp) try: state = read(fp) state.setdefault("verifications", {})[bug_id] = { "scheduled_at": hours_list, "checks": {}, "status": "pending", "created_at": now_iso(), } state.setdefault("_verify_needs_cron", []).append({ "bug_id": bug_id, "hours": hours_list, "created_at": now_iso(), }) state["updated_at"] = now_iso() write(state, fp) return state finally: if lock_held: _release_file_lock(fp) ``` ```python def generate_cron_instructions(bug_id, test_cmd, path=None): state = read(path) vinfo = state.get("verifications", {}).get(bug_id) if vinfo is None: log.error("%s 无验证计划", bug_id) return [] instructions = [] now = datetime.now(TZ) for h in vinfo.get("scheduled_at", []): future = now + timedelta(hours=h) at_iso = future.isoformat(timespec="seconds") instructions.append({ "bug_id": bug_id, "hours": h, "at": at_iso, "message": f"验证 {bug_id} ({h}h复查): 运行 {test_cmd}", "sessionTarget": "isolated", "hint": f"cron add schedule.kind=at at={at_iso} sessionTarget=isolated", }) return instructions ``` ...[truncated 1711 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
lib/event_publisher.py:60
Finding

Workspace-controlled code execution through an unqualified dynamic import

Content
View full analysis
dict: """发布 learn 事件 优先级: 1. 参数 learn_callback(最高优先级) 2. 实例级别 self._learn_callback 3. 动态 import pipeline.learn(向后兼容) 4. fallback 到 events.ndjson """ cb = learn_callback or self._learn_callback if cb is not None: try: cb(data) return data except Exception as e: log.warning("learn callback 失败: %s", e) # callback 失败不 fallback 到 import pipeline——直接返回 return data # 向后兼容: 动态 import pipeline(仅当无 callback 时才尝试) try: import pipeline as _p if hasattr(_p, "learn"): _p.learn(data=data) return data raise ImportError("pipeline.learn not found") except Exception as e: log.warning("learn fail (fallback to events): %s", e) return self.publish( kind=data.get("kind", "fix_closure"), bug_id=data.get("bug_id", "?"), data=data, ) ``` ### Technical Analysis `publish_learn()` performs an unqualified `import pipeline`. Python resolves this name using `sys.path`, which commonly includes the current workspace. A repository can therefore provide a top-level `pipeline.py` that shadows any intended trusted integration. Importing a Python module executes its top-level statements before `hasattr(_p, "learn")` is evaluated. Consequently, the attacker does not need to implement the expected API to achieve code execution. If a `learn()` function is provided, it also receives archived event data, including the filtered root-cause summary and bug metadata. This call is reachable during Phase 3 through `ArchivePipeline.execute()`, which creates `EventPublisher` without a trusted callba ...[truncated 874 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
lib/backend_checker.py:66
Finding

Backend validation executes repository-controlled gateway code during inspection

Content
View full analysis
dict: """检测 gateway.py 是否可导入""" try: # 尝试从 CWD 上层或标准路径导入 import importlib, sys gateway_paths = [ os.path.join(os.getcwd(), "gateway.py"), os.path.abspath("gateway.py"), ] for gp in gateway_paths: if os.path.exists(gp): spec = importlib.util.spec_from_file_location("gateway", gp) if spec is None or spec.loader is None: log.warning("gateway.py 存在但无法加载 spec: %s — 文件可能损坏", gp) continue mod = importlib.util.module_from_spec(spec) spec.loader.exec_module(mod) has_dispatch = hasattr(mod, "dispatch") return {"available": True, "path": gp, "has_dispatch": has_dispatch} except Exception as e: log.warning("gateway 加载失败: %s", e) return {"available": False, "path": None, "has_dispatch": False} ``` ```python bc_result = bc.full_check( test_file=test_path if os.path.exists(test_path) else "", workspace_root=workspace_root, ) ``` ### Technical Analysis The function is intended to determine whether `gateway.py` exposes a `dispatch` function. Instead of statically inspecting the file, it constructs an import specification and calls `exec_module()`. This executes all top-level statements in the repository-controlled file. The exception handler does not mitigate the issue because a payload can execute before raising an error. The operation occurs as part of Phase 2 validation, so merely auditing or testing a repository containing `gateway.py` can trigger its code. ### Attack Path 1. An attacker places a malicious `gateway.py` in the workspace. 2 ...[truncated 705 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
lib/env_detector.py:48
Finding

Unsafe automatic dependency resolution and unpinned development dependencies

Content
View full analysis
=7 pytest-cov>=5 ``` ### Technical Analysis The default Node.js test command uses `npx jest` without `--no-install`. Depending on the installed npm/npx version and local dependency state, `npx` may resolve and download a package from a configured registry when no local executable exists. The package selected at execution time can therefore differ from the package reviewed during the Skill audit. The Python development dependencies use open-ended lower bounds and no hashes. Future versions satisfying these constraints can be installed without source or artifact integrity pinning. The environment detector also returns project-controlled `package.json` script bodies as executable commands. Running repository test scripts is often expected for a testing tool, but it reinforces the need for sandboxing and explicit approval. ### Attack Path 1. A required test tool is not installed locally, or a fresh environment installs depe ...[truncated 700 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
lib/state_manager.py:656
Finding

Automatic recursive cleanup can delete unrelated or traversal-selected directories

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (88)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明描述的是一个较高层的 bug 修复闭环能力,包含测试生成、全量回归、根因标注、周报和重复 bug 重构警报。但该代码块并不执行这些核心功能。它的核心是 phase3 的归档流程:对 BUG_ROOT_CAUSE.md 和 TEST_RESULT.md 做敏感信息过滤,基于历史 ndjson 做循环检测,必要时写出 LOOP_DETECTION.json,随后将修复记录写入 ndjson、发布学习事件、回写过滤后的文件、注册事务回滚动作并注销 session。虽然与“根因标注”或“重复 bug 警报”有弱相关性(使用 root_cause_summary 和 loop detection),但整体主功能明显是归档/收尾,不是描述中的自动测试与回归执行系统。因此描述与实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明描述的是一个面向缺陷处理流程的综合自动化技能,核心应包括生成测试、跑回归、根因分析、周报汇总、重复 bug 预警等。实际代码则主要是“活代码验证后端检查”:检查本地 Ollama API 端点、加载 gateway.py、解析测试代码是否真实调用后端、检查项目数据目录、评估测试输出文本。它并不生成测试,也不实际执行全量回归(除非外部已提供输出),更不做 bug 根因分析、周报或重复 bug 聚类/重构预警。因此主目的与能力集合与声明明显不符,且代码包含一组未在描述中体现的基础设施/验证审计能力。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The declared description presents a high-level automation workflow for bug repair and QA/reporting tasks. However, the supplied code chunk is narrowly focused on checkpoint storage and retrieval for pipeline state. It does not generate tests, execute regressions, analyze root causes, create weekly reports, or detect repeated bugs for refactor alerts. While checkpointing could be a supporting component within such a system, this code chunk by itself does not substantively implement the declared capabilities, so the description does not accurately represent the actual behavior shown.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a high-level bug-remediation automation workflow. However, this code chunk only performs project environment inspection: checking for files like pyproject.toml/package.json/gateway.py, reading package.json scripts, detecting VCS markers, and writing inferred values into a config object. That is a materially different purpose from the declared user-facing functionality. While environment detection could be a supporting component of a larger system, the supplied chunk itself does not implement the described bug-fix/testing/reporting features and does implement an undeclared capability (environment/config detection and application).

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description promises a broad automated bug-fix orchestration mode with testing, regression, root-cause annotation, reporting, and repeated-bug analysis. The supplied code does not implement any of those functions. Instead, it writes structured events to a local NDJSON file, uses file locking, and optionally dispatches a learn callback or dynamically imports pipeline.learn. This is not merely a supporting detail of the described workflow; it is a much narrower and materially different primary function. There are no evident undeclared dangerous permissions, but the description substantially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个面向 bug 修复流程的自动化治理/报告工具,而代码内容集中在检测测试中是否存在 fake data、mock、硬编码断言和低覆盖率等问题。其核心功能、输入输出和使用方式都与声明不符。虽然代码会调用 pytest 做覆盖率检查,这与“回归”有些表面相关,但实际目的只是 L2 检测,不是自动生成测试或执行完整回归流程。因此这是明显的描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个高层研发流程自动化能力集合,围绕 bug 修复后的测试、回归、根因和报告生成展开。而给出的代码块仅是一个 file_ops.py 辅助模块,功能集中在文件锁、原子写入、备份和轮转安全,属于通用底层 I/O 基础设施。虽然文件操作可能作为更大系统的支撑实现细节存在,但该代码块本身并未体现声明中的核心能力,也执行了描述中未提及的具体文件系统和进程级操作。因此描述与实际代码行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明描述的是一个较完整的 bug 修复后自动化流程工具,包含测试生成、回归执行、根因标注、周报和重复 bug 重构警报等多项功能。但提供的代码仅聚焦于“重复 bug/循环模式检测”:它从 ndjson 文件中读取历史记录,比较同类 bug 的数量及 root_cause 文本相似度,并输出是否触发 loop alert。虽然这与描述中的“重复bug重构警报”部分相关,但没有看到自动生成测试、执行回归、周报生成或根因分析/标注的实现。因此描述明显宽于且不同于代码实际主要行为,属于实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个覆盖 bug 修复后续流程的自动化能力集合,核心能力应包括测试生成、回归执行、根因标注、周报汇总和重复 bug 预警。实际代码没有任何测试生成或执行逻辑,也没有周报、去重分析、告警机制。它只处理本地 NDJSON 文件的结构兼容迁移,并做少量字段推断与重写。虽然代码会根据 details/root_cause 推断 bug_type,可勉强算与“标注根因/分类”有轻微相关,但这不足以支持声明中的主要用途。因此描述与实际行为存在明显且实质性的不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

声明描述的是一个面向 bug 修复流程编排与质量保障的自动化模式;而代码块仅实现了本地 NDJSON 记录管理与 schema 校验。它会校验 FixRecord、检查 bug_id 重复、向 ndjson 文件追加记录、校验整个文件并在超过行数阈值时轮转文件。虽然这些功能可能是某个 bug 管理系统的底层支撑,但它们并不等同于描述中列出的核心能力,尤其完全看不到测试生成、回归执行、根因分析、周报汇总或重构告警逻辑。因此描述与实际行为存在明显且实质性的不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

声明描述的是一个高层自动化质量治理/修复流程能力集合,而代码块只是底层持久化组件。它没有生成测试、执行回归测试、产出周报,也没有实现基于重复缺陷模式的重构告警。虽然代码中处理了 root_cause 字段与 bug_id 去重,但这只是记录存储与数据卫生,不等同于“标注根因”或“重复 bug 重构警报”。因此该代码的实际主要用途与声明的核心能力明显不符,应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明描述的是一个覆盖 bug 修复到测试、回归、根因分析、周报和重构警报的综合自动化模式;但给出的代码块只包含 refactoring_alert.py,核心行为是解析 ndjson 日志、统计重复 bug 类型、生成/更新 REFACTORING_ALERT.md、裁剪历史警报块,以及提供 check/generate 命令。它没有执行测试生成、回归测试、周报生成等声明中的关键能力。虽然代码中有对 root_cause 文本的读取和“根源模式”推断,但这只是为警报文案服务的轻量聚合逻辑,不能代表声明中的完整根因标注能力。因此,代码行为只覆盖声明中的一小部分,属于描述与实际行为不符。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

描述强调的是面向 bug 修复工作流的高层自动化能力,而代码仅涉及底层数据持久化与一致性修复。它没有体现自动生成测试、执行回归测试、根因分析、周报产出或重复 bug 检测/重构告警等核心能力。虽然“bug修复”这一大主题可能相关,但该代码块的实际主用途是仓储/事务性存储支持,与声明中的主要功能存在实质性偏差,因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明描述的是一个多能力自动化工作流,涵盖修复后测试生成、回归执行、根因标注、周报和重复 bug 告警等。而实际代码只读取/扫描 BUG_ROOT_CAUSE.md 文件,使用正则检查根因分析层级标签与内容有效性,并输出阻断/审计结果。它没有任何测试生成、测试执行、周报汇总、重复 bug 检测或重构告警逻辑。虽然“标注根因”相关方向与代码的根因验证部分有弱相关,但代码的实际范围只是对根因文档深度做校验,不能代表声明中的整体能力,因此属于明显描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

描述与代码的主用途明显不一致。声明聚焦于研发流程自动化(修 bug、生成测试、跑回归、根因分析、周报、重复 bug 重构告警),而代码完全没有测试生成、回归执行、缺陷分析、报告生成或告警逻辑。相反,代码实现的是敏感数据检测和脱敏过滤,读取指定文件并输出扫描结果或覆盖/写出过滤后的内容。这属于与声明无关且未声明的核心能力,因此应判定为明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

该代码块的主功能与声明的高层自动化 QA/修复流程并不一致。它并没有执行测试生成、回归测试、周报生成或重复 bug 检测告警,而是围绕本地状态持久化和修复记录管理展开。虽有“verification/cron”相关功能,但只是调度和记录验证计划,不等同于自动跑回归。与此同时,代码提供了较完整的状态文件定位、锁、备份恢复、session 生命周期管理、ndjson 持久化、bug 目录清理等能力,这些属于独立且核心的行为,未在声明中体现。因此描述与实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

声明描述的是一个较完整的缺陷修复治理/质量流程工具,包含测试生成、全量回归、根因分析、周报和重复问题预警等多项能力。实际代码仅包含 test_runner.py,其功能是安全执行测试命令(尤其是 pytest)并解析测试摘要,属于“跑回归测试”的一个支撑组件。虽然其中一部分与“跑全量回归”方向相关,但代码没有显示测试生成、根因标注、周报输出或重复 bug 检测/重构警报等关键声明能力,因此描述与实际行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a high-level automated bug-fixing workflow with testing, regression execution, root-cause tagging, reporting, and duplicate-bug/refactor alerts. The supplied code does none of those things. Instead, it provides infrastructure for transactional side-effect management: registering rollback handlers, compensating on failure, clearing/resetting state, and phase-scoped context management. This is a materially different primary purpose, not just a supporting detail of the declared behavior. No evidence in the code shows test generation, regression execution, report generation, or bug analysis capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个面向软件工程流程自动化的 bug 修复辅助能力,而实际代码仅是通用事务/补偿事务基础设施。代码没有实现自动生成测试、运行全量回归、根因标注、周报生成或重复 bug 重构告警;相反,它实现了 do/undo 注册、提交/回滚、文件系统清理 undo、以及 Saga 节点补偿。这属于主要用途明显不一致,且存在未声明的事务与文件系统操作能力,因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

声明描述的是一个覆盖 bug 修复后续自动化闭环的综合模式,包含生成测试、执行回归、根因标注、周报和重复 bug 告警等多项能力。给出的代码块仅包含 validation_chain.py,其职责是串联 root_cause_validator、fake_data_detector 和 backend_checker,对测试文件进行校验并汇总结果。虽然“标注根因”与代码中的根因校验部分部分相关,但其余多数核心宣称能力在代码中没有体现,因此描述与实际行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

声明描述的是一个较完整的修复闭环自动化模式,包含修复、生成测试、执行回归、根因标注、周报和重复 bug 重构警报。实际代码块的主功能只是“周报生成器”:读取 ndjson 日志,筛选某周记录,汇总已有统计字段,输出 Markdown 周报,并提供列出周号的 CLI。它确实涉及周报生成、展示根因摘要,以及根据 bug_type 频次生成重构警报,这与声明的部分后半段一致;但声明中更核心的前半段能力——bug 修复、自动生成测试、跑全量回归——在此代码中完全没有实现,代码只是读取这些结果字段进行汇总。因此该描述对该代码块而言明显夸大了能力,属于目的/能力不匹配。

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The auto-activation criteria are extremely broad, covering explicit bug-fix requests, any failed test, and even generic log warnings. In an agent system, such ambiguity can cause the skill to trigger unexpectedly and perform writes, shell commands, or state changes in contexts where the user did not authorize a remediation workflow.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md
使用 `lib/state_manager.py` 管理 session 生命周期:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 802)May include surrounding context.

md
使用 `lib/state_manager.py` 管理 session 生命周期:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 807)May include surrounding context.

md
使用 `lib/state_manager.py` 管理 session 生命周期: