T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sure_api_cli.js:69- Finding
API Key Forwarding to an Unrestricted Destination
- Content
View full analysis
- Remediation
View remediation
Security audit
Sure API
Security checks for vulnerabilities and agentic risk
Overview
This is a real Sure API helper, but it exposes broad financial-account actions and credential-forwarding paths that need review before installation.
Install only if you are comfortable giving an agent access to your Sure financial account. Use a restricted API key, keep secrets out of command-line arguments, do not let untrusted prompts choose base URLs or curl options, and avoid the raw wrapper for account deletion, reset, auth, or other destructive endpoints unless you have reviewed and explicitly approved the exact request.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sure_api_request.sh:31- Finding
Arbitrary Curl Options Can Cause Credential and File Disclosure
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sure_api_request.sh:22- Finding
Environment Configuration File Is Executed as Shell Code
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sure_api_cli.js:145- Finding
API Key Accepted Through Process-Visible Command-Line Arguments
- Content
View full analysis
`. 2. The shell may record the command in its history. 3. While the process is running, another authorized local process-monitoring user or service reads the argument list. 4. Automation or audit systems may retain the complete command after execution. 5. An attacker with access to any resulting record recovers the API key and uses it against the Sure API. ### Impact Assessment The exposed key can provide unauthorized access to sensitive financial data and write operations permitted by its API scope. This issue does not independently grant operating-system privileges, but it expands secret exposure to local users and logging infrastructure. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sure_api_acceptance.sh:45- Finding
Predictable Temporary Files Permit Symlink-Based File Clobbering
- Content
View full analysis
/tmp/sure_api_summary.check.md cmp -s /tmp/sure_api_summary.check.md "$REF_SUMMARY" || fail "summary out of date; run sure_openapi_update.sh" ok "skill structure and references look good" if [ "${1:-}" = "--with-live-api" ]; then "$SMOKE_SH" >/tmp/sure_api_smoke.out ``` ### Technical Analysis The acceptance script writes to fixed names in the shared `/tmp` directory using ordinary shell redirection. It does not create the files exclusively, verify their type or ownership, or protect against symbolic links. A local attacker can pre-create either path as a symbolic link. When a more privileged account runs the acceptance script, shell redirection follows the link and truncates or overwrites the linked target. ### Attack Path 1. A local attacker predicts one of the fixed paths, such as `/tmp/sure_api_smoke.out`. 2. The attacker creates that path as a symbolic link to a file writable by the privileged runtime account. 3. An agent or administrator runs the acceptance script, optionally with `--with-live-api`. 4. Shell redirection follows the symbolic link. 5. The target file is truncated and overwritten with generated summary or smoke-test output. ### Impact Assessment The attacker may corrupt or overwrite files writable by the account running the acceptance test. If the script runs as root, the scope can include privileged system or application files. Exploitation requires local access sufficient to create entries in the shared temporary directory. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The core declared purpose—accessing the Sure REST API with X-Api-Key auth for several financial resources—mostly matches the implemented CLI. However, the description materially overstates coverage. The code does not implement chats, official docs URL features, upstream OpenAPI self-update behavior, or ClawHub publish readiness. It also declares valuations coverage, and even mentions valuation commands in the usage text, but there are no actual valuations command handlers in the code. This is therefore a description-to-behavior mismatch due to significant declared capabilities that are missing from the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose presents a full API client/integration skill for the sure REST API. The actual code chunk only summarizes an OpenAPI YAML file locally by parsing servers and paths. That is related at most to API specification inspection, but it is not the described primary behavior and does not implement any of the claimed API capabilities or workflows. This is therefore a clear description-behavior mismatch.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The frontmatter explicitly markets self-update capability from an upstream OpenAPI source, signaling that the skill is designed to change itself based on remote content. Even at the metadata level, this expands the trust boundary and can encourage automated workflows that ingest unreviewed external specifications into local artifacts.
- Content
md --- name: sure-api description: Use the we-promise/sure REST API with X-Api-Key auth. Covers accounts, transactions, categories, tags, merchants, imports, holdings, trades, valuations, chats, official docs URLs, self-update workflow from upstream OpenAPI, and ClawHub publish readiness. --- # Sure API
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
This duplicate self-update finding is valid for the same reason: the skill is designed to refresh itself from remote upstream material and regenerate local references. In a skill context, that is more dangerous because agents may treat local references as authoritative after update, so poisoned updates can propagate into later actions.
- Content
md - `422` → validation error; inspect request body against `references/openapi.yaml` - `429` / `5xx` → retry with backoff up to 3 times if the action is idempotent ## Self-update this skill This skill is designed to be self-maintainable.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
This duplicate self-update finding is valid for the same reason: the skill is designed to refresh itself from remote upstream material and regenerate local references. In a skill context, that is more dangerous because agents may treat local references as authoritative after update, so poisoned updates can propagate into later actions.
- Content
md - `422` → validation error; inspect request body against `references/openapi.yaml` - `429` / `5xx` → retry with backoff up to 3 times if the action is idempotent ## Self-update this skill This skill is designed to be self-maintainable.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` frontmatter is valid enough for publishing
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` frontmatter is valid enough for publishing
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The reference includes destructive endpoints for deleting the current user and resetting users, but these capabilities are not reflected in the manifest description. In an agent-integrated skill, hidden destructive operations are especially dangerous because they can enable irreversible account loss or data destruction if the agent is prompted, misconfigured, or granted excessive authority.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The presence of access-token refresh flows indicates the skill can participate in credential lifecycle handling, not just API-key-based requests. In an agent context, this is dangerous because it may prompt for, receive, or retain refresh tokens and access tokens that grant ongoing account access, including to sensitive financial data.
- Content
yaml required: true "/api/v1/auth/refresh": post: summary: Refresh an access token tags: - Auth parameters: []
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The spec includes destructive operations to reset all family financial data and delete the current user account, but the manifest description does not disclose these high-risk capabilities. Hidden destructive actions in a finance skill create a severe risk of irreversible data loss if invoked accidentally, through prompt injection, or via unclear user intent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A family-wide reset operation is far broader than expected for a finance API integration skill that primarily covers accounts, transactions, and reporting data. Because it wipes financial records asynchronously across a family scope, misuse could cause widespread irreversible operational and audit damage.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Account deactivation/deletion is not necessary for typical finance data interaction and is disproportionate to the skill's stated purpose. Exposing this action through an agent increases the risk of accidental or manipulated permanent account loss and deletion of associated data.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md grep -q '^description:' "$SKILL_MD" || fail "SKILL.md missing description" grep -q 'https://github.com/we-promise/sure/tree/main/docs/api' "$SKILL_MD" || fail "SKILL.md missing official docs dir URL" grep -q 'https://github.com/we-promise/sure/blob/main/docs/api/openapi.yaml' "$SKILL_MD" || fail "SKILL.md missing official openapi URL" grep -q 'self-update' "$SKILL_MD" || fail "SKILL.md should explain self-update" grep -q 'ClawHub publish readiness' "$SKILL_MD" || fail "SKILL.md should include publish readiness section" grep -q '/api/v1/accounts' "$REF_SUMMARY" || fail "endpoint summary missing accounts"
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
sh grep -q '^description:' "$SKILL_MD" || fail "SKILL.md missing description" grep -q 'https://github.com/we-promise/sure/tree/main/docs/api' "$SKILL_MD" || fail "SKILL.md missing official docs dir URL" grep -q 'https://github.com/we-promise/sure/blob/main/docs/api/openapi.yaml' "$SKILL_MD" || fail "SKILL.md missing official openapi URL" grep -q 'self-update' "$SKILL_MD" || fail "SKILL.md should explain self-update" grep -q 'ClawHub publish readiness' "$SKILL_MD" || fail "SKILL.md should include publish readiness section" grep -q '/api/v1/accounts' "$REF_SUMMARY" || fail "endpoint summary missing accounts"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents use of shell, network access, and environment secrets, but it does not declare any explicit tool scope or allowed-tools restrictions. That omission can cause an agent platform to grant broader-than-necessary execution authority, increasing the chance of unintended command execution, secret access, or outbound requests when the skill is invoked.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill explicitly enables raw outbound HTTP requests with caller-supplied method, path, and additional curl arguments. In context, this is expected for an API skill, but it still creates a genuine exfiltration and misuse surface because secrets from environment-backed auth may be transmitted to remote endpoints and arbitrary write operations can be performed against the external service.
- Content
md ### Layer 2: raw official endpoint access For any official endpoint not yet wrapped by the high-level CLI, use: - `bash skills/sure-api/scripts/sure_api_request.sh <METHOD> <PATH> [curl args...]` This means the skill can still operate against official endpoints such as: - merchant detail
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented API surface includes authentication-related endpoints such as login, refresh, signup, and SSO exchange that are broader than the skill description suggests. In an agent skill context, undocumented auth capabilities expand what the agent may attempt or be induced to call, increasing the risk of credential handling, token misuse, or unintended access flows.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is described as an X-Api-Key REST integration, but the OpenAPI spec also exposes signup, login, SSO exchange, and token refresh flows. That materially expands capability from data/API access into credential handling and token issuance, which increases the chance the agent will solicit user passwords, OTPs, refresh tokens, or other secrets outside the stated trust boundary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The valuation endpoints mix authentication models by declaring Bearer Authorization headers while the skill metadata claims X-Api-Key authentication. This inconsistency can cause agents or users to provide additional credentials the skill was not expected to handle, expanding secret exposure and creating confused-deputy authentication behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This shell script performs a network request with an API key header and forwards arbitrary curl arguments, which may include request bodies containing user or system data. Although comments describe usage, there is no user-facing disclosure such as a prompt, warning, or runtime log indicating that data and credentials are being sent to a remote endpoint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The markdown includes example payloads using the Chinese string "午饭" for transaction names, but the skill does not state that it is China-specific or that users may choose their preferred language. This can be read as prescribing a specific language/locale in examples, which conflicts with the policy against forcing a locale without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script sources an environment file and accesses the SURE_API_KEY secret, but it provides no warning or disclosure to the user that credentials will be read from disk and used for authentication. For this category, access to sensitive environment variables should have some visible explanation unless already clearly documented in skill documentation.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/sure_api_cli.js:141