T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/build-service-request.mjs:122- Finding
API Key Exposed in Generated User-Visible Curl Command
- Content
View full analysis
- Remediation
View remediation
Security audit
Aicade Create Service
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its AICADE service-management purpose, but it silently reuses local API credentials and prints authenticated curl commands that can expose or enable sensitive operations.
Review before installing. Use this only if you are comfortable with the agent checking AICADE_API_KEY and AICADE_API_SECRET_KEY from the local environment and generating signed administrative curl commands. Avoid putting real API keys or upstream secrets into chat transcripts or logs, prefer redacted or environment-variable-based curl output, and carefully confirm the base URL and serviceId before any disable operation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `scripts/build-service-request.mjs` to print signed curl. The script generates:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `scripts/build-service-request.mjs` to print signed curl. The script generates:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill invokes local shell commands and accesses environment-derived secrets, but it does not declare an explicit tool/permission scope. That creates a governance gap where a user or host system may not realize the skill can execute code or touch sensitive local context, increasing the chance of unintended command execution and secret exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly tells the agent to check local environment variables and reuse API credentials without asking the user again, but provides no user-facing consent or warning. This can lead to silent access to sensitive credentials and use of them in generated signed requests, which is especially risky because the skill is designed around authentication material and request signing.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The instruction to 'use existing local values without asking again' authorizes autonomous use of sensitive local credentials. Even if the script only prints curl, the resulting signed request material can enable privileged operations such as service registration or disablement without a fresh user approval step.
- Content
node {baseDir}/scripts/build-service-request.mjs env-check --operation disable
text Use existing local values without asking again: - `AICADE_API_KEY`: sent as `X-API-Key` - `AICADE_API_SECRET_KEY`: used to generate `X-Signature`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example config sends the upstream API key in the URL query string via
authLocation: QUERYandqueryParam: key. Query parameters are commonly logged by clients, proxies, gateways, load balancers, and observability tools, so this pattern increases the chance of credential leakage even if HTTPS is used. In a service-registration skill, users may copy this example directly into production, making the insecure pattern more likely to propagate.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json { "serviceId": "my-service-01", "serviceName": "My Service", "endpointUrl": "https://api.example.com/v1/endpoint", "requestMethod": "POST", "authType": "NONE", "authLocation": "HEADER",
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The phrase 'do not ask the user to confirm it' directs the agent to make a security-relevant decision autonomously about credential usage. Autonomous handling of secrets reduces transparency and removes an important human approval checkpoint, making accidental or unauthorized authenticated actions more likely.
- Content
node {baseDir}/scripts/build-service-request.mjs env-check --operation register
text If `AICADE_API_KEY` exists locally, use it and do not ask the user to confirm it. If `AICADE_API_SECRET_KEY` exists locally, use it and do not ask the user to confirm it.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to discover and use locally stored API credentials without disclosing that behavior to the user. In an agent setting, this enables silent access to sensitive secrets and generation of authenticated requests on the user's behalf, which breaks user consent and can facilitate unauthorized actions or credential misuse.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This instruction combines two risky behaviors: silently consuming local API credentials and producing a signed request artifact. That makes the skill capable of converting hidden local secrets into actionable authenticated output, increasing the chance of unauthorized API operations, secret misuse, and trust-boundary violations.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
This repeated instruction extends the same autonomous decision-making behavior to the secret signing key, which is especially sensitive because it enables request authentication. Silent use of signing material can allow the agent to prepare valid authenticated operations without the user's informed approval.
- Content
md If `AICADE_API_KEY` exists locally, use it and do not ask the user to confirm it. If `AICADE_API_SECRET_KEY` exists locally, use it and do not ask the user to confirm it. Ask only for missing values:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents a destructive service disable endpoint but provides no requirement to obtain explicit user confirmation before generating or sending a disable request. In a service-management context, this omission can enable accidental or socially engineered disruption of production services, especially because the skill is specifically designed to prepare signed administrative requests.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
This instruction removes user approval for using a locally available API key, allowing the agent to make an autonomous trust decision about sensitive credentials. In an administrative service-management workflow, that behavior weakens user control and can lead to unauthorized request preparation using secrets the user did not intend to expose to the skill.
- Content
node {baseDir}/scripts/build-service-request.mjs env-check --operation disable
text If `AICADE_API_KEY` exists locally, use it and do not ask the user to confirm it. If `AICADE_API_SECRET_KEY` exists locally, use it and do not ask the user to confirm it.
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to automatically use locally stored API credentials without user confirmation, which can cause unintended use of sensitive secrets from the host environment. In this skill's context, those credentials are then used to generate signed requests/curl output, increasing the risk of secret misuse, unauthorized administrative actions, or disclosure through logs/output.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
This instruction similarly authorizes unconfirmed use of the local API secret key, which is more sensitive because it enables request signing for privileged operations. In this skill, the surrounding workflow generates signed administrative curl commands, so automatic use of the signing secret materially raises the risk of misuse and accidental exposure.
- Content
md If `AICADE_API_KEY` exists locally, use it and do not ask the user to confirm it. If `AICADE_API_SECRET_KEY` exists locally, use it and do not ask the user to confirm it. Ask only for missing values: