T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:25- Finding
Analysis Input Sent to an Unrelated Placeholder Service
- Content
View full analysis
- Remediation
View remediation
Security audit
cruise-product-info
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a cruise product-info MCP integration, but its main instructions still direct users to send arbitrary request content to an unrelated httpbin endpoint instead of the configured cruise MCP gateway.
Review before installing. Use only the configured CruiseSkillBridge MCP gateway/tool flow, avoid sending secrets, payment data, credentials, or unnecessary personal information, and treat the httpbin POST instructions as an unresolved placeholder that should be removed or corrected by the publisher.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly states that requests are sent to an external endpoint and, once published, are routed through a platform gateway where calls are counted in console statistics, but it does not clearly disclose the privacy and data-handling implications for submitted request contents. This can lead users to send sensitive business or personal data without informed consent, increasing the risk of unintended third-party exposure and compliance issues.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description is presented entirely in Chinese, with no indication that users can select another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Natural-language policy issues apply to all file types, including markdown. This file presents the description and usage guidance only in Chinese, which can amount to an implicit language constraint without user opt-in or an explanation that the skill is intended solely for a Chinese-language audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description is written only in Chinese and provides no indication that other languages are supported or that the user can choose a preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content