T09 · Insecure Skill Coding Practices
Warning
- Location
CONNECTORS.md:106- Finding
API Credential Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
deepen
Security checks for vulnerabilities and agentic risk
Overview
This research skill is broadly scoped and writes a durable local knowledge base, but the behavior is disclosed and aligned with its purpose.
Install only if you want a persistent research notebook. Before running it, choose a KB directory deliberately, avoid pointing it at private vaults unless that is intended, and prefer provider authentication patterns that do not put API keys in command arguments or saved notes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Semantic Scholar (all fields; JSON; abstracts + citation counts — great for track-record signal):
bash curl -s "https://api.semanticscholar.org/graph/v1/paper/search?query=deliberate+practice+meta-analysis&limit=10&fields=title,abstract,year,authors,citationCount,url,openAccessPdf"Keyless is rate-limited (~100 req / 5 min). A free API key (
x-api-keyheader) raises it; not required.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Crossref (DOIs, metadata across publishers) and OpenAlex (open citation graph) — two more distinct indexes:
bash curl -s "https://api.crossref.org/works?query=spaced+repetition+retention&rows=10&mailto=you@example.com" curl -s "https://api.openalex.org/works?search=spaced%20repetition%20retention&per-page=10&mailto=you@example.com"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Crossref (DOIs, metadata across publishers) and OpenAlex (open citation graph) — two more distinct indexes:
bash curl -s "https://api.crossref.org/works?query=spaced+repetition+retention&rows=10&mailto=you@example.com" curl -s "https://api.openalex.org/works?search=spaced%20repetition%20retention&per-page=10&mailto=you@example.com"Forums — practitioner ground truth + failure-mode signal
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
GitHub (search repos/code/issues; READMEs as raw text). Unauthenticated search works at low rate; a token (
Authorization: Bearer <token>) raises limits and is required for code search:bash curl -s "https://api.github.com/search/repositories?q=agent+skill+expertise&sort=stars&per_page=10" curl -s "https://raw.githubusercontent.com/<owner>/<repo>/HEAD/README.md"If the
ghCLI is installed,gh search repos,gh api, andgh repo vieware simpler.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Exa (neural/embedding search; returns text content inline):
bash curl -s -X POST "https://api.exa.ai/search" \ -H "x-api-key: $EXA_API_KEY" -H "Content-Type: application/json" \ -d '{"query":"operator alpha in Amazon PPC bid management","numResults":10,"contents":{"text":true}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Exa (neural/embedding search; returns text content inline):
bash curl -s -X POST "https://api.exa.ai/search" \ -H "x-api-key: $EXA_API_KEY" -H "Content-Type: application/json" \ -d '{"query":"operator alpha in Amazon PPC bid management","numResults":10,"contents":{"text":true}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Tavily (LLM-tuned search; key in body or as a Bearer token):
bash curl -s -X POST "https://api.tavily.com/search" -H "Content-Type: application/json" \ -d "{\"api_key\":\"$TAVILY_API_KEY\",\"query\":\"sleep apnea AHI thresholds\",\"search_depth\":\"advanced\",\"max_results\":10}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Brave Search (independent web index; key in a header):
bash curl -s "https://api.search.brave.com/res/v1/web/search?q=paddle+core+physics+pickleball" \ -H "X-Subscription-Token: $BRAVE_API_KEY" -H "Accept: application/json"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file says to 'Point this skill at any topic' and gives a wide 'use when the user wants to deeply master, research, or build durable, defensible knowledge on a topic' scope. That trigger language is not narrowly constrained and lacks explicit negative examples beyond 'not for a quick one-off answer,' making unintended invocation more likely for many ordinary research-style requests.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is designed to build a compounding cross-session knowledge base optimized for future agent loading, which creates a durable memory layer. If the topic, sources, or notes include private user data, later runs can resurface that information in unrelated contexts or expose it more broadly than the user intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to create and update persistent files across sessions and to resolve a writable KB path automatically, including defaults and environment-derived locations. Although it says to state the path in the opening line, it still operationalizes local writes by default, which can surprise users, modify unintended directories, or persist sensitive research content without explicit opt-in at execution time.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to search the entire KB root by keyword and meaning encourages broad retrieval across all existing notes, which can pull unrelated sensitive material into the current task. In a multi-topic or multi-user workspace, this increases the risk of cross-context data leakage and unintended incorporation of prior private information into outputs.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes a skill for building durable research knowledge bases, which justifies retrieval from multiple source pools. However, this reference file also recommends use of external command-line tools like
yt-dlp,jq, and local speech-to-text tooling, introducing subprocess/tool-execution capability that is not inherent to the stated purpose and goes beyond simple HTTP-based retrieval guidance.- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
text the Software, and to permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
Static analysis
No suspicious patterns detected.