T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/diagnose.py:403- Finding
Unsanitized User Input Enables Markdown and Terminal Output Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
BP 融资自测清单 · 双轨版（VC × 政府基金）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Chinese-language project screening tool that reads user-provided project JSON and produces local diagnostic reports without hidden network, persistence, or credential behavior.
Install only if you are comfortable with a Chinese-language, China-policy-focused screening workflow. Treat generated reports as preliminary and verify current local fund rules before acting. Avoid feeding it attacker-controlled JSON or rendering generated Markdown with raw HTML or automatic remote-image loading enabled.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to read templates/references and write JSON/report files, but it does not declare any explicit tool scope or permissions boundary. This creates an authorization ambiguity where an agent or runtime may permit broader file access than the skill actually needs, increasing the risk of unintended workspace reads/writes or misuse if the skill is invoked in a sensitive environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L63 says the skill must output in Chinese, yet also says it should match the user's input language. This effectively imposes a specific language and can violate language/locale policy when a user interacts in another language, because no explicit opt-in or alternative is offered.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file's headings, field guidance, and output skeleton are entirely specified in Chinese, which effectively constrains the skill's interaction/output language. The policy allows locale constraints only when they are justified or when the user is given a language/locale choice, neither of which is stated here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire markdown file is written as a Chinese-only rubric and does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the regional constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file's top-level description and usage are entirely in Chinese, and the generated report strings throughout the script are also fixed in Chinese. Because the skill does not provide any mechanism for the user to choose language or locale, it creates a natural-language locale policy concern under the rule for forced language without opt-in.
- Content