test-publish-content

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

This is a small HTTP echo testing skill, but users should avoid sending sensitive text because requests go to a hard-coded external ngrok endpoint and the server logs submitted content.

Install only for development or integration testing. Do not send passwords, tokens, personal information, proprietary text, or production conversation content through this skill unless you control and trust the configured endpoint and logs. For production use, replace the ngrok endpoint with a governed service, remove raw content logging, and pin dependencies with a lockfile.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.yaml:7
• Finding: Undisclosed Transmission of User Content to an Opaque External Endpoint## Vulnerability Details **File Location**: `skill.yaml:7` **Vulnerability Type**: External data exposure through insecure configuration **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml endpoint: https://unlifted-marilynn-untonsured.ngrok-free.dev ``` ### Technical Analysis The skill configuration directs requests to a hard-coded ngrok tunnel whose operator and security controls cannot be established from the project. The skill documentation describes an HTTP echo service but does not disclose that submitted content is sent to this opaque external host. Because `content` can contain arbitrary text, users or agents may unintentionally transmit credentials, personal information, proprietary data, or conversation context to the endpoint operator. TLS protects data in transit but does not prevent the destination server from reading or retaining it. ### Attack Path 1. A user or agent invokes the skill and provides text in the `content` field. 2. The skill framework sends the request to the hard-coded ngrok endpoint. 3. Infrastructure behind that endpoint receives the complete submitted content. 4. The endpoint operator can inspect, retain, or further disclose the data. No local system privileges are obtained through this path. The exposure is limited to information submitted in skill requests and any associated request metadata. ### Impact Assessment The endpoint operator may gain unauthorized access to confidential content supplied to the skill. The scope includes every request routed through the configured endpoint. The severity depends on whether callers submit secrets or sensitive conversation data and on the endpoint operator's logging and retention practices.
• Remediation: ## Remediation Suggestions - Replace the temporary ngrok address with an organization-controlled, documented service endpoint. - Make the endpoint configurable through trusted deployment configuration rather than hard-coding it in the package. - Clearly disclose the destination, operator, data handling, retention, and privacy implications in `SKILL.md`. - Require explicit authorization before sending potentially sensitive content to an external service. - Authenticate requests and validate the remote server's identity using appropriate TLS and deployment controls. - Apply data minimization and reject secrets or other sensitive content when the echo functionality does not require them.

T09 · Insecure Skill Coding Practices

Note

• Location: server.js:8
• Finding: Unredacted User-Controlled Content Written to Application Logs## Vulnerability Details **File Location**: `server.js:8` **Vulnerability Type**: Sensitive information exposure through logging **Risk Level**: Low **Vulnerable Code Snippet**: ```javascript console.log("Received:", content); ``` ### Technical Analysis The application writes the complete user-controlled `content` value to standard output without redaction, truncation, or classification. Although the skill is intended to echo arbitrary text, callers may provide credentials, tokens, personal information, proprietary text, or sensitive conversation context. In typical deployments, standard output is collected by container platforms, process managers, monitoring services, or centralized log systems. This can persist submitted data beyond the request lifecycle and make it accessible to a broader set of operators and systems than intended. User-controlled line breaks and terminal control characters may also reduce log integrity or make entries misleading, although the observed code does not use the logged value for command execution. ### Attack Path 1. A caller submits sensitive or attacker-crafted text in the `content` field. 2. The `/echo` handler extracts the value from the request body. 3. The server writes the complete value to standard output. 4. Deployment infrastructure may collect and retain the entry. 5. Anyone with access to application or centralized logs can retrieve the submitted content. This issue does not grant application execution or elevated operating-system privileges. Its scope is the confidentiality and integrity of application logs and all content processed by this logging statement. ### Impact Assessment Sensitive user data may be retained in logs and disclosed to administrators, support personnel, monitoring providers, or attackers who later obtain log access. Crafted values may also forge or obscure log entries. The impact is bounded to submitted content and downstream copies created by log ...[truncated 20 chars]
• Remediation: ## Remediation Suggestions - Remove logging of raw `content`, as it is unnecessary for the echo operation. - If diagnostics are required, log only non-sensitive metadata such as request identifiers, content length, and processing status. - Apply centralized redaction and truncation before any user-controlled value reaches logs. - Normalize or escape line breaks and control characters to preserve log integrity. - Restrict access to logs and configure short, documented retention periods. - Add tests confirming that secrets and complete request bodies are never emitted to application logs.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest claims a simple echo capability, but the implementation sends input to an external HTTP endpoint instead of performing a local transformation. This creates a capability mismatch that can mislead users and reviewers, and it exposes submitted content to a third-party service without necessity for the stated function.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: For an echo skill, transmitting arbitrary user-provided content to an external network service is unnecessary and introduces avoidable confidentiality and integrity risk. Any sensitive input entered by users could be exposed to the remote operator, logged, retained, or mishandled, especially given the use of an ngrok-exposed endpoint rather than a clearly governed production service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node server.js"
  },
  "dependencies": {
    "express": "^4.18.2"
  }
}

• Confidence: 96% confidence
• Finding: The dependency is specified with a caret range (^4.18.2), which allows installation of newer 4.x releases without a fully reproducible build. This creates supply-chain uncertainty and can unintentionally pull in versions with different security characteristics or behavior across environments.

Unverifiable Dependency: express has 5 known advisory(ies) (CVE-2024-10491 (Express ressource injection); CVE-2014-6393 (No Charset in Content-Type Header in express); CVE-2024-9266 (Express Open Redirect vulnerability) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The manifest references Express without an exact pinned version, while the package family has known advisories. Because the actual installed version may vary, it is not possible to verify from this file alone whether deployment will resolve to a vulnerable release, creating avoidable supply-chain and patch-status ambiguity.