T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create_competition_repo.py:113- Finding
Symlink Traversal Allows Unauthorized Local File Reads During Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
SN94 Competition Poster
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent, but it should be reviewed because its generated validator and benchmark can follow miner-controlled symlinks outside the intended submission folder.
Review and harden generated task repos before any real validation use. In particular, reject symlinks, enforce resolved-path containment under submission/, stream reads with size limits, and run benchmarks in a sandbox with no wallets, API tokens, host secrets, or unnecessary filesystem mounts. Consider narrowing or disabling implicit invocation if installing this skill in an environment where general research requests should not trigger repo creation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python MAX_BYTES = 65536 FORBIDDEN_SUFFIXES = {".pyc", ".pyo", ".so", ".dylib", ".dll"} FORBIDDEN_PARTS = {"__pycache__", ".git", ".env"} def main() -> int: root = Path(sys.argv[1] if len(sys.argv) > 1 else ".")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs use of file reads, file writes, and shell execution (
readreference docs and runpython scripts/create_competition_repo.py) but does not declare any explicit tool scope or permission boundaries. In an agent environment, this can lead to overbroad execution authority, making it easier for the skill to access unintended files or run commands beyond the minimal actions required.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The default prompt uses a very broad trigger phrase and asks the agent to transform a research idea into a full replayable SN94 repository and launch brief without embedding scope limits, safety checks, or eligibility constraints. In systems that support prompt-based skill routing, this can cause the skill to activate in loosely related contexts and steer the agent into performing packaging, repo-construction, or competition-oriented actions the user did not clearly intend.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Implicit invocation is enabled with no narrowing conditions, allowing the platform to auto-select this skill based on vague similarity to topics like research, optimization, pruning, quantization, or agent workflows. Because the skill is designed to create structured repos and launch artifacts, unintended activation could redirect agent behavior, leak context into the wrong workflow, or cause unauthorized task scaffolding in contexts only tangentially related to SN94.
- Content