T09 · Insecure Skill Coding Practices
Warning
- Location
debug-companion.js:105- Finding
Sensitive traceback data is retained and rendered without the documented redaction
- Content
View full analysis
- Remediation
View remediation
Security audit
Debug Companion
Security checks for vulnerabilities and agentic risk
Overview
This debugging skill is mostly purpose-aligned, but it misleadingly promises automatic redaction while retaining and displaying raw traceback and context data that may contain secrets.
Review this skill carefully before installing. It is a normal debugging helper, but do not paste production tracebacks, secrets, tokens, passwords, connection strings, private URLs, or proprietary code unless you have manually redacted them first; the inspected implementation does not perform the automatic redaction it claims.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly encourages users to provide complete tracebacks and related code snippets, but gives no warning that these often contain secrets such as API keys, tokens, internal paths, hostnames, credentials, or proprietary code. In the context of a debugging skill, users are especially likely to paste raw production errors, which increases the chance of sensitive data disclosure to the model or downstream logs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases include very broad everyday expressions such as “出了个bug” and “这个错误怎么修”, as well as direct traceback pasting, which can cause the skill to activate unintentionally in normal conversation. In a tool-enabled skill, overbroad activation increases the chance of unnecessary external searches and unintended processing of sensitive debugging data pasted by the user.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language descriptions and outputs primarily in Chinese, including the skill name, comments describing functionality, and generated user-facing analysis text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The formatOutput function emits all section headers and explanatory labels in Chinese, making the user-visible result language-fixed. Because no language selection or opt-in mechanism is present, this violates the natural-language locale policy for all file types.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README's operational instructions, examples, and warnings are written in Chinese, which effectively forces a specific language for users reading the skill documentation. SQP-3 applies because there is no opt-in language choice or documented rationale that this skill is intended only for a Chinese-speaking or region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文档标题、介绍语和整体使用说明均以中文呈现，且未声明支持用户选择其他交互语言。根据规则，若技能在语言或 locale 上形成默认强制而没有显式 opt-in，属于自然语言层面的组织政策风险。
- Content
Static analysis
No suspicious patterns detected.