T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/coda_cli.py:403- Finding
API Token Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Coda
Security checks for vulnerabilities and agentic risk
Overview
This Coda skill is mostly purpose-aligned, but it needs review because it can change or delete Coda data and has safety and credential-handling gaps.
Install only if you are comfortable giving the skill access to the Coda documents available to your token. Prefer CODA_API_TOKEN over --token, avoid --force unless you are deliberately automating deletion, and verify destructive or mutating commands carefully because retries may repeat some operations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/coda_cli.py:73- Finding
Automatic Retries Can Duplicate Non-Idempotent API Mutations
- Content
View full analysis
= 400: try: error_data = json.loads(text) message = error_data.get("message", "Unknown error") except: message = text or "Unknown error" if status_code == 401: raise CodaAPIError(f"Authentication failed: {message}") elif status_code == 403: raise CodaAPIError(f"Permission denied: {message}") el ...[truncated 3234 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code is clearly a Coda API CLI and broadly aligns with the Coda resource domain, token requirement, and deletion confirmation behavior. However, the declared description overstates implemented functionality in several material areas. The code supports docs (list/get/create/delete), rows (list/insert/update/delete), and read-only listing of tables and pages. It does not implement automation triggers, publishing, permission changes, or full CRUD management for tables/pages despite the description claiming those capabilities. This is a description-to-behavior mismatch because the declared functional scope is materially broader than what the code actually does.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares access to environment variables and network-reachable API operations, but does not define any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: an agent may use sensitive capabilities like reading CODA_API_TOKEN and making outbound requests without clear policy constraints, increasing the chance of unintended data access or exfiltration.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The skill explicitly documents a force-delete path that bypasses confirmation for destructive operations. In an agent context, exposing an unauthenticated or loosely gated
--forceworkflow increases the risk of irreversible deletion of docs or data due to prompt injection, user ambiguity, or autonomous execution without meaningful human verification.- Content
Trigger automation (push button)
python scripts/coda_cli.py automations trigger
Force delete without confirmation (use with caution)
python scripts/coda_cli.py docs delete --force
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python """ ) parser.add_argument("--token", help="Coda API token") parser.add_argument("--force", action="store_true", help="Skip confirmations") subparsers = parser.add_subparsers(dest="cmd_group")
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python """ ) parser.add_argument("--token", help="Coda API token") parser.add_argument("--force", action="store_true", help="Skip confirmations") subparsers = parser.add_subparsers(dest="cmd_group")
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python """ ) parser.add_argument("--token", help="Coda API token") parser.add_argument("--force", action="store_true", help="Skip confirmations") subparsers = parser.add_subparsers(dest="cmd_group")
Static analysis
No suspicious patterns detected.