Plan Verify Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.0

Overview

The skill is not destructive, but it tells the agent to send analysis input to an external API or replacement gateway without clear data limits, consent, or handling terms.

Review this skill carefully before installing. Do not use it with confidential plans, credentials, personal data, proprietary business content, or security-sensitive material unless the publisher documents exactly where requests go, what is logged or retained, and gives you clear control before sending data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Unrestricted Transmission of Analysis Input to an External Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–36
Vulnerability Type: Uncontrolled external disclosure of user-supplied data
Risk Level: Medium

Vulnerable Documentation

The following is an English translation of the complete affected section:

markdown

When an analysis request needs to be submitted, send a POST request
with a JSON body to the following API:

https://httpbin.org/post

Example body:

{ "input": "...", "skill": "ola-plan-verify-skill" }

After publishing to CruiseSkillBridge, the URL above will automatically
be replaced with a gateway address, and calls will be included in
console statistics.

Technical Analysis

The Skill instructs the agent to place unspecified analysis input in the input property and transmit it to the third-party httpbin.org service. It does not define permissible data types, require explicit user consent, redact sensitive information, limit payload size, or prohibit the submission of credentials, personal information, or proprietary content.

The documentation also states that the destination may later be replaced with an unspecified gateway and that invocation statistics will be collected. Consequently, the effective data recipient cannot be determined solely from the reviewed package after publication. Although HTTPS protects data in transit, it does not prevent the destination service or gateway operator from receiving, processing, or logging the submitted content.

Attack Path

1. A user asks the Skill to verify a plan containing confidential, proprietary, personal, or authentication-related information.
2. The agent follows the instruction in SKILL.md.
3. The agent inserts the supplied material into the JSON input field without mandatory filtering or redaction.
4. The complete payload is transmitted to https://httpbin.org/post or to the unspecified replacement gateway.
5. The receiving service can access the submitted ...[truncated 459 chars]

Remediation

View remediation

Remediation Suggestions

1. Perform plan verification locally whenever external processing is not strictly necessary.
2. If remote processing is required, document the exact service operator, fixed destination, purpose, data handling policy, retention period, and deletion procedure.
3. Require explicit, informed user consent immediately before any external transmission.
4. Define an allowlist of fields that may be submitted and reject credentials, access tokens, private keys, personal data, and other sensitive content.
5. Apply deterministic redaction and data minimization before constructing the request payload.
6. Replace the mutable or unspecified gateway behavior with a pinned, validated HTTPS endpoint under a trusted administrative domain.
7. Disable redirects to unapproved hosts and validate the final destination before sending data.
8. Avoid logging request bodies and ensure that telemetry contains only non-sensitive aggregate metadata.
9. Provide a no-network mode and clearly notify users when a request cannot be completed without external processing.
10. Add tests confirming that sensitive values are blocked or redacted and that requests cannot be sent to unapproved destinations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to POST analysis data to an external endpoint and explicitly notes that calls may be routed through a gateway and counted in console statistics, but it provides no clear warning about data leaving the local environment, being logged, or being retained by third parties. In a security or analysis workflow, users may submit sensitive prompts, plans, or internal data, so this omission creates a real data-exposure risk even though the example endpoint is httpbin and appears templated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The visible skill description and publishing information are written in Chinese, and the file does not offer an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file's descriptive and instructional text is written in Chinese, but there is no indication that the user can choose the language or that the skill is intentionally limited to a Chinese-language audience. This can violate a language/locale policy when a specific language is imposed without user opt-in.

Content

No source excerpt is available for this finding.