T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:23- Finding
Unrestricted Recursive Reading of Audit Targets
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Test Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate skill-auditing tool, but it asks agents to read every file in a target skill without enough boundaries for secrets, symlinks, or prompt-injection content.
Install only if you are comfortable giving the agent read access to the skill directories you explicitly choose. Use it on trusted, scoped skill folders; avoid running it on directories containing .env files, private keys, credentials, large unrelated repositories, or symlinks unless the agent has additional guardrails to skip and redact sensitive content.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:45- Finding
Missing Trust Boundary for Adversarial Files Under Audit
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md - 输出格式定义清晰：明确要求单行JSON输出 ✓ ⚠️ **警告项：** - 全大写命令词使用较多（如"**Always invoke**", "**Strict Output Rule**", "**IMPORTANT**"），共发现5处，但都有充分的理由说明，属于合理使用 ### 维度4: 渐进式披露设计（得分：13/15）
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The suggested trigger wording says the skill must activate whenever users mention any time-related terms, which is overly broad and can cause unintended activations. Over-triggering increases the chance that the skill runs in irrelevant contexts, crowding out more appropriate skills and potentially causing users to follow incorrect or overreaching instructions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. `SKILL.md` — always required, read in full
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example recommends activating on broad, common phrasing without defining boundaries, which can make the skill match many ordinary requests outside its intended domain. In multi-skill environments this can crowd out more relevant skills, causing misapplication of instructions and increasing the attack surface for prompt-routing failures.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Repeating the recommendation to make descriptions 'pushy' institutionalizes over-triggering as a best practice, which is unsafe in systems where descriptions influence automatic skill selection. This creates a systemic routing weakness: skills can capture requests too aggressively, leading to unintended execution paths or loading of irrelevant instructions.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The phrase 'any kind of company data' is extremely broad and effectively teaches authors to claim wide swaths of user intent, making false-positive activation likely. In skill-based agents, this kind of trigger inflation can redirect workflows away from better-matched skills and amplify the effect of any problematic instructions contained in the over-triggered skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file contains natural-language instructions and examples that require producing a Chinese report, such as '输出中文的测评报告markdown' and '我将...生成中文报告'. For a general skill-quality reporting artifact, mandating a specific language without offering the user a choice is a locale/language policy violation under SQP-3.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example report recommends adding
allowed-tools: "Read Exec"to a compliance-review skill even though the described purpose is auditing SKILL.md/spec compliance, not executing local code. This normalizes unnecessary tool escalation and could cause downstream users or authors to grant execution privileges to skills that only need read-only analysis, increasing attack surface.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md The validation rules in this skill are based on: - **[Agent Skills Specification](https://agentskills.io/specification)** — the official spec defining SKILL.md format, frontmatter fields, directory structure, and progressive disclosure requirements - **[anthropics/skills — skill-creator](https://github.com/anthropics/skills/blob/main/skills/skill-creator/SKILL.md)** — Anthropic's official skill-creation guide, which defines best practices for writing style, description optimization, trigger tuning, and the "why over MUST" principle - **[anthropics/skills repository](https://github.com/anthropics/skills)** — real-world skill examples used as reference for what good looks like Key principles derived from skill-creator:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description contains very broad trigger phrases like 'check my skill', 'test this skill', and generic review language that can overlap with many ordinary repository-review requests. Because skill descriptions are a primary routing signal, this can cause over-triggering and unintended activation in contexts where the user did not specifically want this skill, leading to misrouting, unnecessary file access, or the wrong workflow being applied.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill unconditionally forces report language based on detected user language and defaults to English when the language is ambiguous, without confirming the user's preference first. This can cause the agent to override user intent, produce outputs in an unwanted language, and make security or compliance findings less understandable or reviewable, especially in mixed-language or multilingual environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guidance explicitly encourages descriptions to be 'pushy' so skills trigger more often, which can cause scope collisions and unnecessary activation of this skill in unrelated contexts. In an agent ecosystem, overbroad trigger criteria can degrade routing reliability and increase the chance that a skill is loaded where its instructions or resources are not appropriate.
- Content
Static analysis
No suspicious patterns detected.