T01 · Skill Instruction Hijacking
Error
- Location
scripts/render_clone_prompt.py:108- Finding
Untrusted Runtime Content Can Hijack the Downstream Model
- Content
View full analysis
- Remediation
View remediation
Security audit
weclone-twin-reply
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent review-gated reply-drafting helper, but users should keep its persona folder tightly curated because it can include extra Markdown files in the generated prompt.
Before installing, treat the persona directory as sensitive: keep only intended persona Markdown files there, review generated prompts before sending them to another model, and do not approve outbound replies unless you have checked the draft and risk flags.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render_clone_prompt.py:86- Finding
Unrestricted Automatic Loading of Additional Persona Markdown Files
- Content
View full analysis
- Remediation
View remediation
` for each additional persona file. 4. Require confirmation before importing extra files and display the resolved file paths to the user. 5. Resolve paths safely and verify that explicitly selected persona extras remain inside the intended persona directory unless external files are deliberately supported. 6. Apply per-file and aggregate size limits to prevent excessive context ingestion. 7. Reject symbolic links or verify their resolved targets when persona-directory containment is required. 8. Scan imported extras for secrets and prompt-injection indicators, and generate review warnings when suspicious content is detected. 9. Record the exact list of included files in the rendered output or an audit log so reviewers can verify the context supplied to the model. ]]>
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill instructs the agent to read persona files and create runtime files like scene.md and dialogue.md, which implies file read/write capability, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can cause an agent runtime to grant broader filesystem access than reviewers expect, increasing the chance of unintended data exposure or file modification.
- Content