T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/validation.md:7- Finding
Client-Controlled Administrative Role Enables Privilege Escalation
- Content
View full analysis
- Remediation
View remediation
Security audit
backend developer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent backend API coding guide with no hidden execution, but it contains security-sensitive examples that could lead agents to generate insecure user and list endpoints.
Review this skill before installing if you expect agents to generate security-sensitive backend code. It is not showing hidden execution or exfiltration, but users should correct the user-creation validation pattern so public clients cannot set roles or activation state, and should add bounded query validation before relying on the route templates.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/templates/feature.route.ts:18- Finding
Unvalidated and Unbounded Pagination Input Reaches Database Queries
- Content
View full analysis
{ try { const { page = 1, perPage = 10, search } = query; const result = await [feature]Repository.findAll(page, perPage, search); return { data: [feature]Mapper.toDtoArray(result.data), meta: { currentPage: page, totalPages: Math.ceil(result.count / perPage), perPage, totalEntries: result.count, }, }; } catch (error) { return handlePrismaError(error); } }, ``` Repository template: ```typescript findAll: async (page: number, perPage: number, search?: string) => { const skip = (page - 1) * perPage; const where: any = { deletedAt: null, // Soft delete filter }; const [data, count] = await Promise.all([ prisma.[feature].findMany({ skip, take: perPage, where, orderBy: { createdAt: 'desc' }, }), prisma.[feature].count({ where }), ]); return { data, count }; }, ``` ### Technical Analysis The list route does not apply a valid query-validation schema. Its `validate(...)` call has no schema or field argument, while the intended validation call is only present as a comment. Depending on the middleware implementation, this can also make the generated route fail when it attempts to use an undefined schema. The service compounds the issue by ...[truncated 1985 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md See `references/utilities.md` for helper functions:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md See `references/utilities.md` for helper functions:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - See `references/senior-engineer-mindset.md` — **READ THIS FIRST** — Thinking patterns, API design, security, performance, code quality standards
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - See `references/senior-engineer-mindset.md` — **READ THIS FIRST** — Thinking patterns, API design, security, performance, code quality standards
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ✅ GET /users/:id → get one ✅ PUT /users/:id → replace ✅ PATCH /users/:id → partial update ✅ DELETE /users/:id → delete ❌ GET /getUsers ❌ POST /createUser
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
❌ GET /getUsers ❌ POST /createUser ❌ GET /user/list ❌ DELETE /deleteUser/:id
text ### Nested Resources — Only When Necessary
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says to use the skill when 'building new REST APIs, implementing features, fixing bugs, or refactoring backend code,' which covers a very wide range of ordinary development activity without clear boundaries. It does not provide specific trigger phrases, exclusions, or negative examples to distinguish when this skill should activate versus other coding skills.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documented AppError class at L260-L267 only defines a code and message, but the error handler at L292-L299 uses err.httpStatus to set the HTTP response status. This is not just incomplete documentation: the shown implementation would produce an undefined status unless AppError carries httpStatus elsewhere, contradicting the claim that these snippets represent the standardized error-handling pattern.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md ❌ `console.log` left in production code ❌ Empty catch blocks that swallow errors ❌ Hardcoded secrets/credentials in code ❌ Unbounded queries (no pagination, no limit) ❌ `any` type everywhere — type everything explicitly ❌ `await` in a loop when Promise.all works ❌ Return raw Prisma entities from services (always map to DTO)
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
At L113 the controller comment states the service returns 'AppError or data', matching the pattern described at L136-L138. But the findAll example at L124-L129 destructures { data, meta } from the service result and then checks whether data is an AppError, which contradicts the stated contract because AppError would be the whole return value, not nested inside data.
- Content