test-publish-content

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

This is a small HTTP echo testing skill, but users should avoid sending sensitive text because requests go to a hard-coded external ngrok endpoint and the server logs submitted content.

Install only for development or integration testing. Do not send passwords, tokens, personal information, proprietary text, or production conversation content through this skill unless you control and trust the configured endpoint and logs. For production use, replace the ngrok endpoint with a governed service, remove raw content logging, and pin dependencies with a lockfile.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.yaml:7

Finding

Undisclosed Transmission of User Content to an Opaque External Endpoint

Content

View full analysis

Vulnerability Details

File Location: skill.yaml:7
Vulnerability Type: External data exposure through insecure configuration
Risk Level: Medium

Vulnerable Code Snippet:

yaml

endpoint: https://unlifted-marilynn-untonsured.ngrok-free.dev

Technical Analysis

The skill configuration directs requests to a hard-coded ngrok tunnel whose operator and security controls cannot be established from the project. The skill documentation describes an HTTP echo service but does not disclose that submitted content is sent to this opaque external host.

Because content can contain arbitrary text, users or agents may unintentionally transmit credentials, personal information, proprietary data, or conversation context to the endpoint operator. TLS protects data in transit but does not prevent the destination server from reading or retaining it.

Attack Path

1. A user or agent invokes the skill and provides text in the content field.
2. The skill framework sends the request to the hard-coded ngrok endpoint.
3. Infrastructure behind that endpoint receives the complete submitted content.
4. The endpoint operator can inspect, retain, or further disclose the data.

No local system privileges are obtained through this path. The exposure is limited to information submitted in skill requests and any associated request metadata.

Impact Assessment

The endpoint operator may gain unauthorized access to confidential content supplied to the skill. The scope includes every request routed through the configured endpoint. The severity depends on whether callers submit secrets or sensitive conversation data and on the endpoint operator's logging and retention practices.

Remediation

View remediation

Remediation Suggestions

• Replace the temporary ngrok address with an organization-controlled, documented service endpoint.
• Make the endpoint configurable through trusted deployment configuration rather than hard-coding it in the package.
• Clearly disclose the destination, operator, data handling, retention, and privacy implications in SKILL.md.
• Require explicit authorization before sending potentially sensitive content to an external service.
• Authenticate requests and validate the remote server's identity using appropriate TLS and deployment controls.
• Apply data minimization and reject secrets or other sensitive content when the echo functionality does not require them.

T09 · Insecure Skill Coding Practices

Note

• Location: server.js:8

Finding

Unredacted User-Controlled Content Written to Application Logs

Content

View full analysis

Vulnerability Details

File Location: server.js:8
Vulnerability Type: Sensitive information exposure through logging
Risk Level: Low

Vulnerable Code Snippet:

javascript

console.log("Received:", content);

Technical Analysis

The application writes the complete user-controlled content value to standard output without redaction, truncation, or classification. Although the skill is intended to echo arbitrary text, callers may provide credentials, tokens, personal information, proprietary text, or sensitive conversation context.

In typical deployments, standard output is collected by container platforms, process managers, monitoring services, or centralized log systems. This can persist submitted data beyond the request lifecycle and make it accessible to a broader set of operators and systems than intended.

User-controlled line breaks and terminal control characters may also reduce log integrity or make entries misleading, although the observed code does not use the logged value for command execution.

Attack Path

1. A caller submits sensitive or attacker-crafted text in the content field.
2. The /echo handler extracts the value from the request body.
3. The server writes the complete value to standard output.
4. Deployment infrastructure may collect and retain the entry.
5. Anyone with access to application or centralized logs can retrieve the submitted content.

This issue does not grant application execution or elevated operating-system privileges. Its scope is the confidentiality and integrity of application logs and all content processed by this logging statement.

Impact Assessment

Sensitive user data may be retained in logs and disclosed to administrators, support personnel, monitoring providers, or attackers who later obtain log access. Crafted values may also forge or obscure log entries. The impact is bounded to submitted content and downstream copies created by log ...[truncated 20 chars]

Remediation

View remediation

Remediation Suggestions

• Remove logging of raw content, as it is unnecessary for the echo operation.
• If diagnostics are required, log only non-sensitive metadata such as request identifiers, content length, and processing status.
• Apply centralized redaction and truncation before any user-controlled value reaches logs.
• Normalize or escape line breaks and control characters to preserve log integrity.
• Restrict access to logs and configure short, documented retention periods.
• Add tests confirming that secrets and complete request bodies are never emitted to application logs.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest claims a simple echo capability, but the implementation sends input to an external HTTP endpoint instead of performing a local transformation. This creates a capability mismatch that can mislead users and reviewers, and it exposes submitted content to a third-party service without necessity for the stated function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

For an echo skill, transmitting arbitrary user-provided content to an external network service is unnecessary and introduces avoidable confidentiality and integrity risk. Any sensitive input entered by users could be exposed to the remote operator, logged, retained, or mishandled, especially given the use of an ngrok-exposed endpoint rather than a clearly governed production service.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a caret range (^4.18.2), which allows installation of newer 4.x releases without a fully reproducible build. This creates supply-chain uncertainty and can unintentionally pull in versions with different security characteristics or behavior across environments.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"start": "node server.js"
  },
  "dependencies": {
    "express": "^4.18.2"
  }
}

Unverifiable Dependency: express has 5 known advisory(ies) (CVE-2024-10491 (Express ressource injection); CVE-2014-6393 (No Charset in Content-Type Header in express); CVE-2024-9266 (Express Open Redirect vulnerability) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The manifest references Express without an exact pinned version, while the package family has known advisories. Because the actual installed version may vary, it is not possible to verify from this file alone whether deployment will resolve to a vulnerable release, creating avoidable supply-chain and patch-status ambiguity.

Content

No source excerpt is available for this finding.