T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:198- Finding
Hardcoded PostgreSQL Credentials in Docker Compose Example
- Content
View full analysis
- Remediation
View remediation
Security audit
Fisi
Security checks for vulnerabilities and agentic risk
Overview
This is a German vocational IT training skill made of Markdown references; it does not install or execute code itself, but some copyable examples are powerful admin commands that need care.
Install only if you want a German FiSi training/reference skill. Treat command snippets as examples, especially firewall, deletion, Docker cleanup, account creation, and credential examples; review them in a lab first, replace all sample passwords, and avoid running system-changing commands on production hosts without backups and rollback access.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (7)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:559- Finding
Predictable Plaintext Active Directory Password in Runnable PowerShell Example
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/docker-referenz.md:34- Finding
Hardcoded Database Password Repeated in Docker Reference
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
references/linux-befehle.md:11- Finding
Destructive Filesystem Command Presented Without Safety Guardrails
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
references/docker-referenz.md:74- Finding
Docker Prune Command Can Remove Required Local Resources
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:598- Finding
Firewall Example Can Lock Out Remote Administrators
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:531- Finding
Backup Retention Deletes Files Without Validation or Dry Run
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The cleanup function performs rm -f on a path assembled from a variable, and the script presents it as a reusable example without strong safeguards. Although the glob is quoted and therefore less explosive than an unquoted wildcard, destructive file removal in instructional automation still carries risk if the path variable is changed, empty, or misunderstood by users adapting the script.
- Content
md # Funktion: Fehlerbehandlung cleanup() { echo "Fehler aufgetreten. Bereinige..." rm -f "${BACKUP_DIR}/tmp_*" exit 1 } trap cleanup ERR
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description says to use the skill for 'allen Themen' of FiSi training and lists a very wide range of common request forms such as 'Hilf mir', 'Erstelle ein Konzept', and 'Bewerte diese Architektur'. In a markdown/manifest context, this makes invocation scope broad and ambiguous, with no exclusion conditions or negative examples to clarify when the skill should not activate.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Befehle:
bash # Besitzer und Gruppe setzen sudo chown www-data:webentwickler /var/www/projekt # Berechtigungen: rwxr-x--- (750) sudo chmod 750 /var/www/projekt
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Befehle:
bash # Besitzer und Gruppe setzen sudo chown www-data:webentwickler /var/www/projekt # Berechtigungen: rwxr-x--- (750) sudo chmod 750 /var/www/projekt
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Befehle:
bash # Besitzer und Gruppe setzen sudo chown www-data:webentwickler /var/www/projekt # Berechtigungen: rwxr-x--- (750) sudo chmod 750 /var/www/projekt
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo chown www-data:webentwickler /var/www/projekt # Berechtigungen: rwxr-x--- (750) sudo chmod 750 /var/www/projekt # SGID-Bit setzen (Gruppenvererbung) sudo chmod g+s /var/www/projekt
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo chown www-data:webentwickler /var/www/projekt # Berechtigungen: rwxr-x--- (750) sudo chmod 750 /var/www/projekt # SGID-Bit setzen (Gruppenvererbung) sudo chmod g+s /var/www/projekt
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sudo chmod 750 /var/www/projekt
SGID-Bit setzen (Gruppenvererbung)
sudo chmod g+s /var/www/projekt
oder: sudo chmod 2750 /var/www/projekt
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
SGID-Bit setzen (Gruppenvererbung)
sudo chmod g+s /var/www/projekt
oder: sudo chmod 2750 /var/www/projekt
text **Oktalnotation:**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The iptables example flushes existing firewall rules and sets default-drop policies without an explicit safety warning or rollback guidance. If copied blindly, it can immediately disrupt connectivity, including locking out remote administrators or breaking production traffic.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The quick reference includes
docker system prune -awithout warning that it removes unused images, containers, networks, and build cache, which can disrupt environments and cause accidental data or artifact loss. In a terse cheat sheet, users may copy-paste destructive commands without understanding their scope, making this operationally risky.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file includes
rm -rf verzeichnis # Löschen (rekursiv, ohne Nachfrage), which performs irreversible deletion and explicitly notes that it runs without prompting. The reference does not provide any warning about data loss or advise caution, so users are not clearly alerted to the destructive nature of the command.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
useradd -m -s /bin/bash user # Benutzer erstellen usermod -aG gruppe user # Benutzer zu Gruppe hinzufügen passwd user # Passwort setzen chmod 755 datei # Berechtigungen setzen chown user:gruppe datei # Besitzer ändern id user # Benutzerinfo anzeigen
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
systemctl start dienst # Dienst starten systemctl stop dienst # Dienst stoppen systemctl restart dienst # Dienst neustarten systemctl enable dienst # Autostart aktivieren systemctl status dienst # Status anzeigen journalctl -u dienst -f # Logs live anzeigen
text
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill name, description, and user-facing instructional content are presented entirely in German, and the file does not indicate that users may choose another language. This can be a language-policy issue when a skill constrains output locale by default without opt-in or documented justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The backup script deletes files via find -delete and also contains cleanup logic using rm, but does not prominently warn about data-loss risk or recommend dry-run validation. In an educational skill that may be copied by learners, this raises the chance of accidental deletion, especially if variables are modified incorrectly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill content is written in German, including headings and labels, without offering a language choice or documenting that the skill is intentionally region- or locale-specific. This can violate language/locale policy when users are not given an explicit opt-in or alternative.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
All visible instructional text in the skill file is German, and there is no indication that the user can choose another language or that the skill is intentionally restricted to a German-language audience. This may violate the language/locale policy for natural-language content when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document title, section headers, and command explanations are all in German, which effectively forces a specific language for users consuming the skill content. There is no indication that German is an intentional locale-specific constraint or that users may choose another language.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The markdown references commands to start, stop, restart, and enable services, which can affect system availability and persistence across reboots. The file does not include any caution that these actions may interrupt running workloads or change system behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Commands such as
apt upgradeandapt remove paketchange installed software and may alter or remove system components. The markdown does not warn that these operations can affect system stability, compatibility, or availability.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire reference file uses German-language headings and explanations, which can impose a language choice on users without opt-in. Under the language/locale policy check, this is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
- Content
Static analysis
No suspicious patterns detected.