T09 · Insecure Skill Coding Practices
Error
- Location
scripts/package_project.py:269- Finding
Unvalidated Package Name Allows Arbitrary File Writes and Template Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
CodeAssist Kotlin + Compose
Security checks for vulnerabilities and agentic risk
Overview
This Android project generator is purpose-aligned, but its documented shell workflow and scaffolding script can write outside the intended project or execute unintended commands if given crafted names.
Review before installing or using this skill. It is not evidence of deliberate malware, but only use trusted app and package names, avoid copying its shell commands with raw user input, keep generated output in a dedicated folder, remove unnecessary Android network permissions, and avoid cleartext HTTP unless strictly required and scoped.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:39- Finding
User-Controlled Project Names Are Embedded in Shell Commands
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:84- Finding
Generated Applications May Enable Cleartext HTTP Globally
- Content
View full analysis
- Remediation
View remediation
legacy.example.com ``` 3. Reference the configuration from the application manifest instead of setting global cleartext permission: ```xml ``` 4. Prohibit cleartext transmission of credentials, authentication tokens, personal data, or other sensitive information. 5. Add an explicit warning to the Skill documentation describing interception and response-tampering risks. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to create, scaffold, and package full Android projects, which implies file creation and modification, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a mismatch between documented authority and actual capability, increasing the risk of unintended file writes or broader workspace modification if the skill is auto-invoked.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger text is very broad, including generic phrases like creating an app or project, which can overlap with many ordinary requests not specifically intended for this skill. Over-broad routing increases the chance the skill is invoked in inappropriate contexts, where it may begin writing files or packaging outputs the user did not explicitly request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill description is written to enforce Portuguese-language behavior without any indication that this is conditioned on user preference. Forced language behavior can cause misleading responses, reduce user understanding of generated code or instructions, and increase the chance of unsafe acceptance of outputs the user cannot easily validate.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template requires INTERNET and ACCESS_NETWORK_STATE permissions in every generated Android project even though the skill is a general Kotlin/Compose project generator, not a network-specific one. This violates least privilege and normalizes unnecessary network access, increasing privacy risk and expanding the attack surface of all generated apps if later code, libraries, or ads transmit data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Granting network capability by default gives every generated app the ability to send and receive data without any stated functional requirement. In a code-generation skill, this is more dangerous because downstream users may trust the scaffold as minimal and safe, then unknowingly ship apps with unnecessary exfiltration capability.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The template instructs adding network permissions without any warning about privacy, data handling, or the effect on app capabilities. While this is primarily a transparency and secure-defaults problem rather than a direct exploit by itself, it increases the chance that users will generate and distribute over-privileged apps without understanding the implications.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file instructs users to store data in SharedPreferences and internal files, and to perform HTTP requests, but it does not include any warning about persistence, transmission, or potential privacy implications. Under the markdown-specific SQP-2 criteria, descriptions that omit warnings for behaviors affecting user data or privacy should be flagged.
- Content