T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:126- Finding
Unrestricted Git Staging Can Publish Sensitive or Unrelated Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Developer Agent
Security checks for vulnerabilities and agentic risk
Overview
This developer workflow is mostly coherent, but it asks agents to forward all user links and attachments to Cursor and to push and merge repository changes with too little safety gating.
Review carefully before installing. Use only in repositories where the agent is allowed to push and merge to staging, and do not provide secrets, private URLs, customer data, credentials, or broad attachments unless you are comfortable with them being sent to Cursor. Require a staged diff, explicit file list, secret scan, and separate approval before any commit, push, merge, or deployment-triggering action.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cursor-guidelines.md:5- Finding
Mandatory Wholesale Forwarding of User Resources to an External Agent
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs sending all user-provided links and attachments to Cursor without any filtering, minimization, or sensitivity review. That creates a blanket exfiltration path for potentially sensitive material such as internal documents, secrets, credentials, proprietary code, or personal data to another model/service that may not need all of it.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation step repeats the instruction to send the approved plan plus all user links and attachments to Cursor, again creating unrestricted third-party sharing of user-supplied content. Because this occurs during execution, it can expose a broader set of materials and normalize unnecessary data transfer as part of the implementation pipeline.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to perform git add/commit/push, merge into staging, and push deployment-related changes, then monitor release/build/deploy pipelines, but it does not require a fresh explicit confirmation immediately before actions that can change shared repositories or trigger environment-impacting deployments. In this context, the skill is specifically designed to orchestrate development and deployment workflows, which makes the missing safety interlock more dangerous because the instructions are operational, concrete, and likely to be followed as written.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guidance explicitly instructs users to always include all user-provided links and attachments when sending work to Cursor, but provides no filtering, minimization, or sensitivity checks. In a development-agent context, attachments and links may contain secrets, internal documents, tokens, private code, customer data, or privileged URLs, so this creates a real risk of unintended data exfiltration to another tool or model.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document imposes a fixed model usage distribution across all tasks, which can override case-by-case safety, privacy, cost, or capability considerations. In an orchestration skill that coordinates development work, this can pressure the system to select suboptimal or less appropriate models even when task sensitivity or risk would warrant an exception.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow explicitly instructs operators to include user-provided links and attachments when sending prompts to Cursor, but it provides no data-classification step, consent check, or warning about third-party disclosure. In a development-agent context, those attachments may contain proprietary source code, secrets, internal documents, or personal data, so forwarding them can cause unintended data exposure to an external system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The planning template normalizes attaching user links and files wholesale, without limiting sensitive content or warning that this information may be transmitted outside the immediate environment. Because this skill orchestrates software development, the shared materials are especially likely to include internal architecture, unreleased code, credentials in documents, or customer data, making the omission materially risky.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The implementation template directs sending all user links and attachments to Cursor, which creates a broad default data-transfer behavior with no minimization or sensitivity screening. In this context, implementation-phase artifacts often include exact code, configs, logs, and test data, so the skill increases the chance of leaking sensitive technical or business information to an external tool.
- Content
Static analysis
No suspicious patterns detected.