Security audit

TabTab Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent TabTab API integration, but it gives a configurable endpoint the user's API key and uploaded data without enough boundary checks.

Install only if you trust the TabTab service and understand that prompts, selected files, task metadata, event logs, and downloaded outputs may pass through the configured remote API. Keep TABTAB_BASE_URL unset or fixed to the official HTTPS origin unless you intentionally use a trusted private instance, protect scripts/env like a secret, and avoid uploading confidential or regulated data without explicit approval.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/hello.sh:14
Finding: API Key and Sensitive Data Disclosure Through an Unrestricted Base URL
Content: View full analysis
Remediation: View remediation
&2 exit 1 ;; esac ``` 3. For a supported set of enterprise instances, implement an exact hostname allowlist rather than substring or suffix matching. Parse and validate the URL with a proper URL parser where possible. 4. Require HTTPS and reject: - Plaintext HTTP. - Embedded URL credentials. - Unexpected ports. - Fragments and malformed URLs. - Unapproved hostnames. 5. Constrain curl protocols: ```bash curl --proto '=https' --proto-redir '=https' ... ``` 6. Do not enable cross-origin redirects for authenticated requests. If redirects are required, validate the final origin before transmitting an authorization header. 7. Treat `scripts/env` as security-sensitive configuration. Verify its ownership and permissions before sourcing it, and do not source a file writable by other users. 8. Clearly notify users that prompts and selected files are transmitted to the configured remote service, and require explicit user selection of every uploaded file. 9. Rotate the API key immediately if requests may have been sent to an untrusted destination. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/get-events.sh:32
Finding: Predictable Temporary Output Paths Permit Symbolic-Link File Overwrites
Content: View full analysis
&2 curl -sf "$URL" -H "Authorization: Bearer $KEY" | jq '.' > "$OUT_FILE" ``` Downloaded ZIP files are handled similarly: ```bash OUT="${TABTAB_OUT:-/tmp/tabtab-${TASK_ID}.zip}" URL="$BASE/open/apis/v1/tasks/$TASK_ID/download" [ -n "$DIR" ] && URL="${URL}?dir=${DIR}" HTTP_CODE=$(curl -s -o "$OUT" -w "%{http_code}" \ "$URL" -H "Authorization: Bearer $KEY") if [ "$HTTP_CODE" != "200" ]; then echo "Download failed, HTTP $HTTP_CODE:" >&2 cat "$OUT" | jq '.' 2>/dev/null || cat "$OUT" >&2 rm -f "$OUT" exit 1 fi ``` ### Technical Analysis Both scripts generate default filenames from a caller-supplied task identifier and place them directly in the shared `/tmp` directory. They neither create files atomically nor verify whether the destination already exists, is a regular file, or is a symbolic link. Shell redirection and `curl -o` follow symbolic links. If another local user can obtain or anticipate the task identifier and create the expected pathname as a symbolic link, running the script can truncate or replace the symlink target with event JSON or downloaded data. The scripts also accept arbitrary output paths through `TABTAB_EVENTS_FILE` and `TABTAB_OUT`. While custom output paths are intentional, no exclusive-creation or symlink checks are applied before writing. File permissions are inherited from the caller's `umask`, so sensitive task events or output archives may receive permissions broader than inte ...[truncated 1659 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes broad shell-driven API automation but does not declare any explicit tool scope or permission boundaries. In practice this increases the chance an agent invokes shell/network actions without a clearly documented trust boundary, which is risky for a skill that supports file upload, scraping, database access, and artifact download.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill is described with very broad, open-ended capabilities and few trigger boundaries or exclusions. For an agentic integration that can scrape sites, query databases, upload files, and download outputs, vague scope increases the risk of unsafe invocation, overcollection of data, or unintended high-impact actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill advertises external data movement functions—file upload, web scraping, database querying, and sandbox output download—without a consolidated privacy and sensitivity warning. That omission makes accidental transmission of confidential or regulated data more likely, especially in autonomous or semi-autonomous workflows.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
TABTAB_API_KEY="sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" TABTAB_BASE_URL="https://tabtabai.com" # optional EOF chmod 600 "$(dirname "$0")/scripts/env"

text
All scripts automatically source `scripts/env` on startup if the file exists — no further setup needed.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
TABTAB_API_KEY="sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" TABTAB_BASE_URL="https://tabtabai.com" # optional EOF chmod 600 "$(dirname "$0")/scripts/env"

text
All scripts automatically source `scripts/env` on startup if the file exists — no further setup needed.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
### File restrictions | Restriction | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Max file size | 50MB per file | | Max files per task | 20 files |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
| Restriction | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Max file size | 50MB per file | | Max files per task | 20 files | | Supported types | PDF, Word (.doc, .docx), Excel (.xls, .xlsx), PowerPoint (.ppt, .pptx), Text (.txt, .md), Images (.jpg, .jpeg, .png, .gif, .webp, .bmp, .svg, .tiff, .tif, .ico), Archives (.zip, .rar, .7z, .tar, .gz) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
| Restriction | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Max file size | 50MB per file | | Max files per task | 20 files | | Supported types | PDF, Word (.doc, .docx), Excel (.xls, .xlsx), PowerPoint (.ppt, .pptx), Text (.txt, .md), Images (.jpg, .jpeg, .png, .gif, .webp, .bmp, .svg, .tiff, .tif, .ico), Archives (.zip, .rar, .7z, .tar, .gz) | **Note:** MIME type validation is lenient. The primary validation is based on file extension. This accommodates variations in MIME type reporting across different browsers and systems.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/create-task.sh (reported line 46)May include surrounding context.
sh
--argjson files "$FILES" \ '{message: $message, mode: $mode, run_mode: $run_mode, params: $params, files: $files}') RESP=$(curl -sf -X POST "$BASE/open/apis/v1/tasks" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d "$BODY")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code transmits data over HTTP and uses a sensitive credential from TABTAB_API_KEY, but the script provides no explicit user-facing warning, confirmation, or disclosure beyond terse usage comments. For code files, network calls and credential use should have some visible warning unless clearly disclosed as part of the skill behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language content in comments and parameter error messages is entirely in Chinese, which imposes a specific language on users without opt-in or justification. Under the policy, forcing a language or locale without user choice is a natural-language policy violation unless the regional constraint is clearly documented.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script performs a destructive operation by sending a terminate request for a running task, but it provides no confirmation prompt, warning message, or runtime disclosure before doing so. Although comments describe the script's purpose, there is no explicit user-facing warning at execution time for this irreversible action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code performs a network POST that transmits user-specified local files to an external endpoint using curl. Although the script's purpose is uploading, the file itself does not include any explicit warning that file contents will leave the local system or may contain sensitive data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Earlier sections explicitly recommend writing the API key to scripts/env and state that scripts automatically source that file (L038-L050). The comment in the end-to-end example says 'never store secrets in a file,' which directly conflicts with that documented setup approach and can mislead users about the intended handling of credentials.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The configuration section recommends creating scripts/env in the skill directory and says all scripts source it automatically (L038-L049). Best Practice item 3 then tells users to 'Never store secrets in plain-text files inside the skill directory,' which is an active contradiction rather than a mere omission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comments and user-facing stderr/error strings are written exclusively in Chinese, including usage instructions and runtime messages. This imposes a specific language on users without offering a choice or documenting a justified locale constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Comments, usage guidance, and parameter error messages are written only in Chinese, which imposes a language choice on users without opt-in. The policy forbids forcing a specific language or locale unless the constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This shell script includes user-facing natural-language text only in Chinese, including comments describing usage and the runtime error message requesting the API key. That imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script reads a bearer API key from an environment variable and transmits it in an HTTP Authorization header, but the code provides no user-facing notice beyond the variable name itself. For code-file review, network calls carrying credentials should include some disclosure, logging, or documentation warning so users understand that authentication data will be sent to the configured endpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script requires TABTAB_API_KEY and uses it as a Bearer token for the outbound request. While this is functional, there is no warning or note about protecting the credential, avoiding shell history exposure, or the security implications of sourcing it from an env file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.