FDE Agent Skill Designer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed skill and demo builder, but its runnable POC scaffold can turn untrusted names or scenarios into executable local JavaScript, so it needs review before use.

Review or fix the scaffold generator before installing in workflows that may use copied, customer-provided, or otherwise untrusted POC names or scenarios. Until escaping and validation are added, only run generated POCs with trusted metadata, keep them away from production credentials and real customer data, and run them in a constrained local environment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scaffold-poc.js:37

Finding

Arbitrary JavaScript Injection in Generated POC Server

Content

View full analysis

{ console.log(`{{POC_NAME}} started:http://127.0.0.1:${port}`); }); ``` ### Technical Analysis The `--name` argument is accepted without character validation or context-sensitive escaping. The generator performs a raw textual replacement of `{{POC_NAME}}` in every supported template file, including `server.js`. Because the placeholder occurs inside a JavaScript template literal, a value containing a backtick can terminate the string and introduce arbitrary JavaScript statements. The generated server is explicitly presented to the user as runnable output: ```js console.log(`Start server: node ${path.join(output, 'server.js')}`); ``` The vulnerable operation is source-code generation rather ...[truncated 1526 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/minimal-poc/index.html:6

Finding

HTML Injection in Generated POC Interface

Content

View full analysis

{{POC_NAME}} ``` ```html

FDE MINIMUM POC · v0.1.0

{{POC_NAME}}

{{SCENARIO}}

``` ### Technical Analysis The `--name` and `--scenario` values are inserted as raw markup into the generated document. No HTML entity encoding is applied before values are written into the ``, `<h1>`, and `<p>` elements. An input containing closing tags and executable markup can therefore escape its intended text node. For example, a scenario containing an element with an event handler would be interpreted by the browser as markup rather than displayed as literal text. The browser-side application safely uses `textContent` for interactive task input, but that protection does not cover metadata inserted during scaffold generation. The page also lacks a restrictive Content Security Policy that could mitigate inline script or event-handler execution. ### Attack Path 1. An attacker supplies or influenc ...[truncated 1249 chars]

Remediation

View remediation

`, `"`, and `'`. 2. Prefer loading metadata from validated JSON and assigning it through `textContent`: ```js document.querySelector('h1').textContent = metadata.name; document.querySelector('#scenario').textContent = metadata.scenario; ``` 3. Use distinct, context-aware encoders for HTML, JSON, and JavaScript. Raw global string replacement is not safe across these file types. 4. Add a restrictive Content Security Policy, for example one that disallows inline scripts and event handlers. 5. Validate input lengths and reject control characters where they are not required. 6. Add security regression cases containing closing tags, script elements, SVG payloads, event-handler attributes, entity sequences, and malformed Unicode. 7. After generation, parse the HTML and verify that metadata remains in text nodes and cannot introduce additional elements or attributes. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about Stage 5 delivery work: turning approved materials into a reusable Agent Skill and, when needed, constructing a minimal runnable prototype with mocks and evaluations. The supplied code does none of that. It only validates the filesystem structure and metadata of an existing skill package by reading local files (SKILL.md and agents/openai.yaml), checking naming/frontmatter/link rules, and reporting blockers/warnings. While validation could be a supporting detail of packaging, this code chunk’s primary purpose is materially different from the declared purpose and omits the core claimed behaviors such as packaging, prototype construction, guardrails/evaluation assembly, or demo creation.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

6. Write the core `SKILL.md` and move detailed rules, templates, and scripts into progressively loaded resources.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

6. Write the core `SKILL.md` and move detailed rules, templates, and scripts into progressively loaded resources.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs use of scripts and scaffolding that imply file-system, environment, and potentially network-capable execution, but it does not declare an explicit tool scope or permission model in machine-readable metadata. That gap can cause an agent runtime to overgrant capabilities or leave operators without a clear least-privilege boundary, increasing the chance of unintended external access or writes during packaging and POC generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The HTML document sets lang="zh-CN", which establishes a fixed language/locale for the page. In this file there is no visible opt-in, alternate language path, or justification that the skill is intended only for a China-specific audience, so this appears to violate the language/locale choice policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template includes a 'Trigger conditions' field but provides no required schema, constraints, or examples to ensure activation is narrowly scoped. In a skill-design package, this can lead authors to define vague or overly broad activation criteria, causing the agent to run in unintended contexts and potentially perform sensitive actions without sufficient user intent or boundary checks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/platform-adapters.md (reported line 56)May include surrounding context.

md

- Claude's custom Skills also use the directory containing `SKILL.md`;
-`name` Use only lowercase letters, numbers and hyphens to avoid platform reserved words;
-`description` Also write down what to do and when to use it;
- Keep references and scripts loaded on demand, don't cram everything into `SKILL.md`.

### Claude Code

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation criteria are broad enough that ordinary user requests like 'quickly verify the interaction' or 'create a skills file' could unintentionally switch the agent into POC build mode. In a skill that is specifically authorized to scaffold runnable artifacts, ambiguous triggering increases the risk of unauthorized code/package generation or bypass of the normal staged design process.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The phrase "Only continue to output skill design packages" is written in a document otherwise rendered in non-native English and may imply a fixed output-language/style requirement without offering user choice. Under the language/locale policy, skills should not force a specific language or locale unless the user opts in or the constraint is clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger 'Need to process bill explanation ticket' is broad and does not define precise activation conditions, exclusions, or required prechecks. In an agent setting, ambiguous activation boundaries can cause the skill to run on the wrong ticket types or in mixed-intent conversations, increasing the chance of unsafe automation, policy misuse, or drafting responses for cases that should be escalated.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.md (reported line 7)May include surrounding context.

md

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The text specifies that 'The Chinese version and the English version use the same skill ID and field version' but does not describe how a platform or user selects the language. Under the policy, forcing or presuming locale behavior without explicit user choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This file is markdown, so natural-language policy review applies. The section title 'Fight censorship' introduces a normative stance without clarifying scope, neutrality, or user opt-in, which can conflict with organizational expectations for neutral language handling.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: assets/minimal-poc/poc-manifest.json:21