other
Error
- Location
pipeline-cli.yaml:28- Finding
Mandatory Transmission of Sensitive PII to a Remote Service Is Not Accurately Disclosed
- Content
View full analysis
- Remediation
View remediation
Security audit
Expanso pii-detect
Security checks for vulnerabilities and agentic risk
Overview
The skill does PII detection, but it can send sensitive text to OpenAI despite advertising an optional local regex path, and its HTTP mode listens on all interfaces without authentication.
Review before installing. Do not use this skill on regulated, customer, employee, payment, health, or identity data unless you are comfortable sending the full text to OpenAI under your own data-handling rules. Treat the advertised local regex mode as unavailable in this artifact. If using MCP mode, bind it to localhost or a private interface, add authentication and rate limits, and avoid exposing it directly to a network.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
pipeline-mcp.yaml:8- Finding
Unauthenticated PII Detection Endpoint Is Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
pipeline-mcp.yaml:27- Finding
Untrusted Input Can Inject Instructions into PII Detection Prompts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This pipeline sends raw stdin content directly to the OpenAI chat completion API, and the skill is specifically designed to process text that may contain sensitive PII. Because the file provides no explicit user-facing warning or consent mechanism before external transmission, users may unknowingly exfiltrate personal data to a third-party service, creating privacy, compliance, and data-handling risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This skill invites submission of arbitrary text for PII scanning, then forwards that text to an external model API, but the file contains no warning, disclosure, or consent mechanism informing users that their sensitive content leaves the local environment. That omission increases the chance of unintended privacy violations, regulatory exposure, and misuse in environments where users assume scanning is local.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The pipeline sends raw user-supplied text, explicitly expected to contain PII, to the external OpenAI API for processing. Even though this is the skill’s functional purpose, it still creates a real confidentiality risk because sensitive data is disclosed off-box without any visible authorization boundary, minimization, or alternative local processing path in this file.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill accepts arbitrary text for PII scanning and includes a remote OpenAI backend, but the manifest does not clearly warn that submitted text may be transmitted off-system to a third-party LLM service. Because the input is likely to contain sensitive personal data by design, this omission can cause unintended disclosure of PII, compliance violations, and unsafe routing of regulated data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README demonstrates sending raw PII directly into the skill, including examples with SSNs, credit card numbers, addresses, and dates of birth, but does not clearly warn users that highly sensitive personal data may be transmitted to an LLM-backed service or otherwise processed externally. In a privacy-focused skill, omission of an explicit data-handling warning can lead to unsafe deployment decisions, accidental regulatory exposure, or inappropriate use on production data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash PORT=8080 expanso-edge run pipeline-mcp.yaml & curl -X POST http://localhost:8080/detect \ -H "Content-Type: application/json" \ -d '{ "text": "Please contact jane.doe@company.com or call 555-987-6543",
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This is a manifest file, so vague-trigger review applies. The description only states the capability to detect PII in text, but provides no explicit invocation phrases, scope limits, or negative examples that would clarify when this skill should or should not activate.
- Content
Static analysis
No suspicious patterns detected.