T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:43- Finding
Shell Command Injection Through User-Controlled Event Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Add Pi Events D1
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned for managing site events, but it uses broad Cloudflare credentials and live database mutation commands in ways that need careful review.
Install only if you control the target Cloudflare account and are comfortable with an agent making live event database changes. Before use, pin Wrangler, use a dedicated least-privilege D1 token, avoid sourcing a shared env file, and require explicit confirmation before insert, update, or delete commands.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:46- Finding
Unpinned Wrangler Dependency May Execute Mutable Third-Party Code
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:41- Finding
Broad Credential File Is Executed Instead of Minimally Scoped Credentials Being Loaded
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The skill instructs the agent/operator to source
~/.env/.env, directly accessing stored Cloudflare credentials. Exposing credential-loading steps inside an agent skill is dangerous because any misuse of the skill, prompt injection into downstream content, or accidental logging can lead to token disclosure and full remote access to production infrastructure.- Content
1. Load credentials
bash source ~/.env/.env # Provides: $CF_API_TOKEN, $CF_ACCOUNT_ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
This step combines loading credentials from a local env file with immediate remote execution against Cloudflare D1. The context makes the issue more dangerous because the token is used in a production write path, so any compromise of the shell session, package toolchain, or injected command content can result in unauthorized database modification and credential theft.
- Content
3. Execute against D1 (remote)
bash source ~/.env/.env cd /Users/viki/Projects/projects/marketing-bull/babenchuk-com CLOUDFLARE_API_TOKEN="$CF_API_TOKEN" \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
Although this example is read-oriented, it still instructs loading Cloudflare credentials from a local env file into a general shell session. That broadens secret exposure unnecessarily and can leak tokens through shell history, debugging, process inspection, or compromised helper tooling.
- Content
List all upcoming events:
bash source ~/.env/.env CLOUDFLARE_API_TOKEN="$CF_API_TOKEN" CLOUDFLARE_ACCOUNT_ID="$CF_ACCOUNT_ID" \ npx wrangler d1 execute mb-events --remote --command "SELECT id, name, date_start FROM events WHERE date_start >= date('now') ORDER BY date_start ASC;"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger phrase "Add an event to the site" is broad enough to match ordinary conversational requests that may not imply authorization to write directly to a live database. In this skill, activation leads to immediate production D1 modification, so ambiguous triggering increases the risk of unintended or socially engineered execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The phrase "Update PI events" does not specify the system, data source, or whether the request is read-only or mutating. Because this skill performs live writes to Cloudflare D1, the ambiguity makes accidental invocation and unauthorized modification more likely in normal conversation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Schema
sql CREATE TABLE events ( id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, address TEXT,
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The skill invokes
npx wranglerwithout pinning a specific package version, which can cause execution of whatever version npm resolves at runtime. In a privileged workflow that loads Cloudflare credentials and performs remote D1 writes, this creates a supply-chain risk where a compromised or incompatible wrangler release could execute with access to live infrastructure.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
This instance again uses unpinned
npx wranglerfor remote database operations. Because the command is run with Cloudflare API credentials in environment variables, any malicious or unexpected package version could abuse those credentials or alter production data.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The verification step still depends on unpinned
npx wrangler, preserving the same supply-chain exposure. Even read-oriented commands can leak credentials, query sensitive data, or execute arbitrary package lifecycle behavior when the tool version is not fixed.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
This query command uses unpinned
npx wranglerwhile loading Cloudflare credentials from the user's environment. The combination of dynamic package fetching plus privileged remote access increases the chance of supply-chain compromise leading to credential theft or unauthorized D1 actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The delete example uses unpinned
npx wranglerfor a destructive production action. If the fetched package is malicious or unexpectedly changed, it can both tamper with live data and misuse loaded credentials, making this more dangerous than a generic tooling reference.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
This update workflow again relies on a dynamically resolved
npx wranglerbinary in a credentialed, production-facing context. That exposes the operator to package substitution, compromised releases, or breaking changes that could modify data or exfiltrate Cloudflare tokens.- Content