skill-release-gate

• Outcome: Review
• Latest audit: Oct 16, 2026 · 11:28 PM UTC
• Version: 1.0.0

Overview

This local release-gate skill is not malicious, but its scanners can miss files and its declared entry point can skip a required scan, so it needs review before relying on it.

Review this skill before installing it as a release gate. It is offline and does not appear to exfiltrate or persist data, but do not treat its pass result as sufficient until the traversal bug, basename skip bypass, and entry-point mismatch are fixed. If used anyway, run both scripts explicitly on a clearly chosen directory and consider independent secret scanning.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/desens_check.py:57

Finding

Incomplete Directory Traversal Allows Sensitive Content to Bypass Desensitization Checks

Content

View full analysis

Vulnerability Details

File Location: scripts/desens_check.py, lines 57-66
Vulnerability Type: Incomplete security scanning caused by incorrect loop indentation
Risk Level: Medium

Vulnerable Code

python

if os.path.isfile(a.path):
    targets = [a.path]
else:
    targets = []
    for root, dirs, files in os.walk(a.path):
        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
    for f in files:
        fp_full = os.path.join(root, f)
        if os.path.basename(fp_full) in SELF_SKIP:
            continue
        if os.path.splitext(f)[1].lower() in SCAN_EXT:
            targets.append(fp_full)

Technical Analysis

The loop that processes files is outside the os.walk() loop. Consequently, root and files retain only the values from the final directory visited by the traversal. Files in the root directory and earlier nested directories are not added to targets and are therefore never inspected.

When none of the files from the final visited directory match a desensitization pattern, the script reaches the following success path and reports that the artifact passed:

python

if not results:
    print("[PASS] 去敏复核通过：未检出内部路径/内网域名/工作区片段/指定姓名。")
    sys.exit(0)

This contradicts the documented release-gate behavior, which requires the complete artifact to have zero findings before release.

Attack Path

1. An artifact provider creates a release directory containing multiple directories.
2. The provider places internal paths, internal hostnames, workspace identifiers, or a name supplied through --names in a file located outside the last directory visited by os.walk().
3. The release workflow invokes desens_check.py --path <artifact-directory>.
4. The vulnerable traversal omits that file from targets.
5. The scanner finds no issue in the limited set of files it actually inspects and exits successfully.
6. The incomplete success result ca ...[truncated 633 chars]

Remediation

View remediation

Remediation Suggestions

Move file processing inside the os.walk() loop:

python

for root, dirs, files in os.walk(a.path):
    dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
    for f in files:
        fp_full = os.path.join(root, f)
        if os.path.basename(fp_full) in SELF_SKIP:
            continue
        if os.path.splitext(f)[1].lower() in SCAN_EXT:
            targets.append(fp_full)

Additionally:

1. Reject nonexistent paths rather than treating them as an empty successful scan.
2. Track and report unreadable files instead of silently continuing.
3. Add regression tests with findings in the root, intermediate directories, and deeply nested directories.
4. Verify that the number of scanned files matches the expected artifact inventory before returning a pass result.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/secret_scan.py:20

Finding

Basename-Based Exclusions Allow Files to Evade Both Release Scanners

Content

View full analysis

Vulnerability Details

File Locations: scripts/secret_scan.py, lines 20 and 61-62; scripts/desens_check.py, lines 21 and 62-63
Vulnerability Type: Overbroad security-scanner exclusion
Risk Level: Medium

Vulnerable Code

In scripts/secret_scan.py:

python

SELF_SKIP = {"secret_scan.py", "desens_check.py"}

python

for f in files:
    fp_full = os.path.join(root, f)
    if os.path.basename(fp_full) in SELF_SKIP:
        continue
    if os.path.splitext(f)[1].lower() in SCAN_EXT:
        targets.append(fp_full)

In scripts/desens_check.py:

python

SELF_SKIP = {"secret_scan.py", "desens_check.py"}

python

for f in files:
    fp_full = os.path.join(root, f)
    if os.path.basename(fp_full) in SELF_SKIP:
        continue
    if os.path.splitext(f)[1].lower() in SCAN_EXT:
        targets.append(fp_full)

Technical Analysis

Both scanners attempt to avoid self-matches by excluding their own source filenames. However, the exclusion compares only os.path.basename(fp_full) against a fixed set.

The check therefore does not distinguish the scanners' actual package paths from unrelated artifact files with the same names. Any file named secret_scan.py or desens_check.py, at any scanned directory depth, is skipped in its entirety by both tools.

Because an artifact provider controls the artifact's filenames and contents, this creates a deterministic scanner bypass. The exclusion is broader than necessary for avoiding self-referential pattern matches and undermines the documented requirement that the complete release artifact receive zero findings.

Attack Path

1. An artifact provider creates a file named secret_scan.py or desens_check.py inside the artifact under review.
2. The provider places PII, credentials, tokens, private-key material, internal paths, internal hostnames, workspace identifiers, or specified names in that file.
3. T ...[truncated 1021 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not exclude files solely by basename.
2. Resolve the scanners' exact paths and exclude only those specific files when the scanned target contains the scanner package:

python

scanner_dir = os.path.dirname(os.path.realpath(__file__))
excluded_paths = {
    os.path.realpath(os.path.join(scanner_dir, "secret_scan.py")),
    os.path.realpath(os.path.join(scanner_dir, "desens_check.py")),
}

candidate = os.path.realpath(fp_full)
if candidate in excluded_paths:
    continue

3. Prefer scanning every artifact file and narrowly suppress only known self-referential pattern definitions rather than excluding whole source files.
4. Keep scanner implementation files outside the artifact input directory where practical.
5. Add regression tests containing sensitive patterns in nested files named secret_scan.py and desens_check.py, and require both scanners to detect them.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file content is entirely in Chinese and instructs agents and maintainers to use this document as the operational guide, but it does not offer an alternative language or indicate that Chinese is a justified region-specific requirement. This creates a natural-language policy concern because it effectively imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest declares a single CLI entry point of scripts/desens_check.py, but the skill documentation states that release gating requires running both secret_scan.py and desens_check.py. This mismatch can cause orchestrators or users to invoke only the declared entry point, silently skipping secret/PII scanning and creating a false sense of security before release.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The English trigger phrases are broad (for example, generic release-gate and pre-release terms) without clear boundaries for when the skill should or should not activate. In agentic environments, ambiguous triggers can cause accidental invocation on unrelated content or workflows, potentially applying release decisions or scans in the wrong context and creating workflow confusion or policy bypass opportunities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Chinese trigger phrases are similarly vague and do not specify invocation scope, authorization conditions, or target artifacts. This increases the chance of unintended activation in multilingual deployments, where the skill may run or influence decisions based on loosely related phrasing rather than explicit operator intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language description in L3 is entirely prescriptive in Chinese and presents the skill's governance requirements as universal ("所有 ... 必过") without indicating any language choice or opt-in. Under the policy, forcing a specific language or locale without user choice is a reportable natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This is a real flaw: the for f in files: loop is mis-indented outside the os.walk() loop, so only the final directory visited is scanned instead of the full tree. In a desensitization checker, that creates a false sense of safety and can let sensitive paths, internal hostnames, or real names remain in unscanned files and be published.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language strings that require Chinese comprehension for usage and behavior, including the module docstring and command descriptions. Because the skill does not offer a user language/locale choice or justify a Chinese-only constraint, it conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.