T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:39- Finding
Unauthenticated Endpoints Expose Restricted Landlord and Financial Records
- Content
View full analysis
- Remediation
View remediation
Security audit
Farmos Land Portfolio
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its farming finance purpose, but it handles sensitive landlord and payment data through weakly scoped access and cleartext API/token instructions.
Review before installing. This skill is for a sensitive business system and should only be used where the FarmOS API is protected by real server-side authentication, TLS, least-privilege tokens, and explicit confirmation for bulk or year-end changes. Do not rely on the local role file as the only access boundary.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:127- Finding
Bearer Tokens and Sensitive API Data Are Transmitted over Cleartext HTTP
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:121- Finding
Authentication Example Encourages Acquisition of an Overprivileged Administrator Token
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: farmos-land-portfolio description: Query land ownership, leases, landlord info, and land payments. Write operations for payment management and lease renewals. tags: [farming, land, leases, landlords] ---
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest understates the skill's write capabilities by mentioning only payment management and lease renewals, while the body also documents year-end rollover execution that creates future payment records. This mismatch can cause users or policy systems to underestimate the operational scope and approve a more powerful skill than intended.
- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 81% confidence
- Finding
The skill explicitly favors endpoints that return all matching records with no truncation, which can produce very large responses. In an agent workflow, unbounded output can exhaust context windows, degrade reliability, and increase exposure of sensitive financial and landlord data beyond what is necessary for the user's request.
- Content
md ### Upcoming Payments (next N days) GET /api/integration/payments/upcoming?days=30 - Returns ALL upcoming payments within N days (no truncation) - Use `days=60` or `days=90` for longer lookahead ### Leases (FULL)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill exposes single and bulk state-changing operations such as marking payments paid and renewing leases, but it does not require an explicit user-facing warning that these actions modify business records. In an agent setting, insufficient confirmation language increases the risk of accidental or misunderstood destructive changes at scale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Year-end rollover execution can create next year's payment schedules and materially affect future financial records, but the documentation does not clearly warn about the scope and persistence of those changes. Because this operation creates new records rather than simply updating existing ones, accidental execution could cause widespread accounting and planning errors.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest understates the skill's write capabilities by mentioning only payment management and lease renewals, while the body also documents year-end rollover execution that creates future payment records. This mismatch can cause users or policy systems to underestimate the operational scope and approve a more powerful skill than intended.
- Content
Static analysis
No suspicious patterns detected.