T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:41- Finding
Mutable Remote Payload Retrieval and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Intelligent Data Governance
Security checks for vulnerabilities and agentic risk
Overview
The skill may be useful for data governance, but its install steps run unpinned code from an external GitHub repository and the documentation is too vague for sensitive enterprise data use.
Review the external GitHub repository and dependencies before installing, pin to a known commit if possible, and run it in an isolated environment with least-privilege access. Do not connect production, regulated, or sensitive enterprise data sources until the tool's data handling, permissions, logging, and change behavior are clear.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description and feature list are broad and do not define clear activation boundaries, permitted operations, or constraints around handling enterprise data. In an agent setting, vague scope can lead to overbroad use on sensitive systems or datasets, increasing the chance of unsafe actions, excessive access, or misuse beyond the author's intended context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation advertises data security, permission management, and lineage tracking capabilities but does not warn that these functions may expose, classify, or operate on sensitive enterprise information. In a governance/security context, missing sensitivity warnings and handling guidance can cause users or agents to process confidential metadata, access controls, or lineage records without adequate review, creating real confidentiality and authorization risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language description and documentation are written entirely in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language or locale policy where skills should not force a specific language without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest description uses only Chinese text, which may imply a fixed language experience without any stated opt-in, alternative language, or documented region-specific scope. Under the language/locale policy check, this can be a natural-language policy concern when the skill appears to force a specific language by default.
- Content
Static analysis
No suspicious patterns detected.