T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/freedcamp.mjs:174- Finding
Session Token and Workspace Metadata Stored Without Explicit Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Freedcamp Project Management
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims for Freedcamp, but it automatically stores reusable session credentials locally in a way that needs review before installation.
Review before installing on shared or less-trusted machines. Use a dedicated low-privilege Freedcamp API credential if possible, avoid commands that print stored config values, and remove or protect the local session cache when rotating credentials or disabling the skill.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js * * Usage: node skill/scripts/demo.mjs * * Loads .env from project root automatically if env vars aren't set. */ import { execFileSync } from "node:child_process";
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js * * Usage: node skill/scripts/demo.mjs * * Loads .env from project root automatically if env vars aren't set. */ import { execFileSync } from "node:child_process";
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js // Load .env if needed function loadEnv() { if (process.env.FREEDCAMP_API_KEY && process.env.FREEDCAMP_API_SECRET) return; const envFile = path.join(ROOT, ".env"); if (!fs.existsSync(envFile)) return; for (const line of fs.readFileSync(envFile, "utf-8").split("\n")) { const match = line.match(/^(?:export\s+)?(\w+)=(.+)$/);
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to run config inspection commands that can print stored skill configuration values, including the API key, without warning that this may expose secrets in terminal history, screen recordings, shared shells, or logs. In this skill’s context, the credential material grants direct access to a third-party project-management account, so accidental disclosure can lead to unauthorized API use.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
node scripts/freedcamp.mjs task <task_id>
text ### 5) Create a task ```bash node scripts/freedcamp.mjs create-task --project <project_id> --title "New task"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The skill advertises user-invocable functionality that uses both environment-provided secrets and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens policy enforcement and reviewability: an agent may invoke a capability-bearing skill without a clear, machine-readable boundary around secret access and external API calls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation instructs users to configure and store API credentials and then perform read/write API operations, but it does not provide safety guidance around secret handling, least-privilege use, output redaction, or the fact that commands can modify remote account data. In an agent context, missing warnings increase the chance of accidental credential exposure, unsafe persistence of secrets, or unintended task/comment changes in a live workspace.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill persists sensitive session material, including a Freedcamp API session token and associated user data, to a predictable local file path in the user's home directory. Because the file is written without explicit permission controls, encryption, or user disclosure, other local users, processes, or later agent runs may access reusable credentials and account metadata if filesystem permissions are weak or the host is shared.
- Content
Static analysis
Detected: suspicious.env_credential_access, suspicious.potential_exfiltration
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/freedcamp.mjs:22
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/freedcamp.mjs:180