T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:14- Finding
PowerShell Execution Policy Is Weakened Beyond the Required Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
PowerSkills
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate-looking Windows automation toolkit, but it gives an agent broad control over email, browser sessions, desktop input, and shell commands without enough scoping or safety guidance.
Install only if you intentionally want an agent to operate Outlook, a browser, the desktop, and PowerShell on your Windows account. Prefer installing only the specific sub-skill you need, verify any missing PowerShell scripts from a trusted release before running them, avoid persistent execution-policy changes, use a separate disposable Edge profile for CDP, and require explicit approval before sending email, submitting forms, typing keystrokes, launching apps, or running shell commands.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/browser/SKILL.md:15- Finding
Edge Remote Debugging Is Enabled Without Session Isolation or Endpoint Hardening
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises powerful capabilities including Outlook access, browser automation, screenshots, keystrokes, and shell execution, but it does not prominently warn users that these functions can access sensitive data and materially affect the host system. In an AI-agent skill context, this omission is risky because operators may install or expose the skill to agents without understanding that it enables surveillance, credential capture, command execution, and data exfiltration workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to start Edge with a remote debugging port but does not explain that DevTools remote debugging can expose tabs, cookies, page contents, and browser control to any process that can reach that port. In this skill's context, that increases risk because the browser automation feature is specifically intended for agent use, so enabling CDP without warnings or binding restrictions may unintentionally grant broad access to sensitive browsing sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises powerful capabilities including shell execution, Outlook access, browser automation, screenshots, window management, and keystrokes, but the top-level documentation does not warn that these actions can access sensitive data or change system state. In an agent context, this lack of explicit safety framing increases the chance that users or orchestrators enable the skill without understanding its privacy and execution risks.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md | Skill | Description | |-------|-------------| | [outlook](skills/outlook/SKILL.md) | Email & calendar via Outlook COM | | [browser](skills/browser/SKILL.md) | Edge automation via CDP | | [desktop](skills/desktop/SKILL.md) | Screenshots, window management, keystrokes | | [system](skills/system/SKILL.md) | Shell commands, processes, system info |
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md | Skill | Description | |-------|-------------| | [outlook](skills/outlook/SKILL.md) | Email & calendar via Outlook COM | | [browser](skills/browser/SKILL.md) | Edge automation via CDP | | [desktop](skills/desktop/SKILL.md) | Screenshots, window management, keystrokes | | [system](skills/system/SKILL.md) | Shell commands, processes, system info |
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md |-------|-------------| | [outlook](skills/outlook/SKILL.md) | Email & calendar via Outlook COM | | [browser](skills/browser/SKILL.md) | Edge automation via CDP | | [desktop](skills/desktop/SKILL.md) | Screenshots, window management, keystrokes | | [system](skills/system/SKILL.md) | Shell commands, processes, system info |
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md | [outlook](skills/outlook/SKILL.md) | Email & calendar via Outlook COM | | [browser](skills/browser/SKILL.md) | Edge automation via CDP | | [desktop](skills/desktop/SKILL.md) | Screenshots, window management, keystrokes | | [system](skills/system/SKILL.md) | Shell commands, processes, system info |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly advertises JavaScript execution, form filling, clicking, and typing in an already-authenticated Edge session, but the description provides no safety warning that these actions can operate with the user's existing cookies, tokens, and account state. In an agent context, that omission increases the chance of unsafe automation such as account changes, unintended purchases, data extraction, or submission of sensitive information to untrusted sites.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill supports launching arbitrary applications yet omits a warning that starting programs can execute code with side effects such as network access, file modification, installer execution, or privilege prompts. While app launch is expected in this tool's context, lack of disclosure can cause unsafe agent behavior or surprise users about execution risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill supports launching arbitrary applications yet omits a warning that starting programs can execute code with side effects such as network access, file modification, installer execution, or privilege prompts. While app launch is expected in this tool's context, lack of disclosure can cause unsafe agent behavior or surprise users about execution risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description uses broad activation language such as 'use when needing to check work email, read/send Outlook messages, search mail, or view calendar,' which overlaps with many routine user requests. In an agentic system, this can cause the skill to be invoked in situations where the user did not explicitly intend email or calendar access, increasing the chance of unnecessary access to sensitive mailbox data or accidental outbound actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documents send and reply capabilities, including drafting and direct sending, without warning that these actions modify external communications on the user's behalf. In an autonomous or semi-autonomous agent context, this raises the risk of accidental email transmission, unintended replies, disclosure of sensitive information, and impersonation through the user's Outlook identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly exposes arbitrary PowerShell command execution and environment-variable access, but the description does not warn that these capabilities can execute destructive system actions or reveal sensitive data such as secrets in environment variables. In an agent-facing skill, this omission is security-relevant because it lowers operator awareness and increases the chance of unsafe invocation, prompt-driven abuse, or accidental data exposure.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill supports launching arbitrary applications yet omits a warning that starting programs can execute code with side effects such as network access, file modification, installer execution, or privilege prompts. While app launch is expected in this tool's context, lack of disclosure can cause unsafe agent behavior or surprise users about execution risk.
- Content