Security audit

Farmos Marketing

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for farm marketing lookups, but it documents access patterns that could expose sensitive business and financial data without adequate protection.

Review before installing. This skill should only be used on a trusted private network with users who are authorized to view the farm's marketing and financial data. Prefer HTTPS, avoid exposing or logging JWTs, use manager-scoped tokens unless admin is required, and treat the no-auth integration endpoints as sensitive unless the server enforces proper authorization elsewhere.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:60
Finding: Unauthenticated Access to Sensitive Farm Financial and Operational Data## Vulnerability Details **File Location**: `SKILL.md`, lines 60–94 **Vulnerability Type**: Missing authentication and authorization on sensitive API endpoints **Risk Level**: High ### Vulnerable Code ```markdown ## Integration Endpoints (No Auth — for cross-module data) These provide summary data without authentication. Use for quick lookups and cron jobs. ### Dashboard Summary GET /api/integration/dashboard Returns: Contract counts, bushels sold, delivery schedule stats, recent settlements. ### Revenue Summary GET /api/integration/revenue?crop_year=2025&entity_id=1 Returns: Revenue by crop (corn/soybeans), by month, contracted vs projected. Use for cash flow analysis. ### Entities GET /api/integration/entities Returns: All farm entities with id, name, type, short_code. Use to map entity names to IDs. ### Fields with Ownership GET /api/integration/fields?entity_id=1 Returns: Fields with acres, entity ownership shares. ### Acres Summary GET /api/integration/acres-summary Returns: Total acres by entity with field counts and ownership shares. ### Settlements by Month GET /api/integration/settlements-by-month?crop_year=2025&entity_id=1 Returns: Monthly settlement amounts for cash flow timing. ### Crop Years GET /api/integration/crop-years Returns: Available crop years with current year flag. ``` ### Technical Analysis The skill explicitly identifies these integration endpoints as requiring no authentication. The exposed information includes contract counts, sold quantities, delivery schedules, recent settlements, revenue projections, entity identities, field ownership, acreage, and settlement timing. This conflicts with the skill's stated access model, under which marketing information requires a manager or administrator role. Because no caller identity or role is verified, any party with network access to the API can retrieve data that would otherwise be protected by role-b ...[truncated 1973 chars]
Remediation: ## Remediation Suggestions 1. Require authenticated requests for every endpoint that returns marketing, settlement, revenue, ownership, acreage, or delivery information. 2. Enforce manager-level authorization server-side rather than relying on the skill to check a local role mapping. 3. Apply object-level authorization to `entity_id` parameters so callers can access only authorized entities. 4. Replace anonymous cron access with dedicated service accounts or short-lived, narrowly scoped machine tokens. 5. If anonymous summaries are operationally required, expose only coarse, non-sensitive aggregates and suppress entity identifiers, revenue, settlements, ownership, and delivery details. 6. Add rate limiting, access logging, anomaly detection, and alerts for sequential entity or crop-year enumeration. 7. Review historical access logs to determine whether the anonymous endpoints have already been queried unexpectedly. 8. Add automated authorization tests that verify anonymous users receive `401 Unauthorized` and insufficiently privileged users receive `403 Forbidden`.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:46
Finding: JWT Bearer Tokens Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md`, lines 46–48 **Vulnerability Type**: Cleartext transmission of reusable authentication credentials **Risk Level**: High ### Vulnerable Code ```bash curl -H "Authorization: Bearer $TOKEN" http://100.102.77.110:8013/api/endpoint ``` The same plaintext protocol is configured as the API base at line 57: ```text http://100.102.77.110:8013 ``` ### Technical Analysis The skill instructs the Agent to place a manager or administrator JWT in an HTTP `Authorization` header and transmit it over an unencrypted connection. HTTP provides neither confidentiality nor server authenticity. A party capable of observing network traffic can read the bearer token, while an active network attacker can redirect or modify requests and responses. A bearer token grants access based on possession alone. Therefore, an intercepted token can be replayed without knowing the user's password. The documented 15-minute expiration limits the replay window but does not prevent exploitation during that period. An administrator token would expose the full privileges encoded in that token. Plaintext transport also permits response manipulation. An active attacker could alter financial or operational API results consumed by the Agent, potentially influencing contract, inventory, delivery, or field-priority recommendations. ### Attack Path 1. A legitimate Agent invokes the authentication helper and obtains a manager or administrator JWT. 2. The Agent sends an HTTP request containing `Authorization: Bearer {token}` to `100.102.77.110:8013`. 3. An attacker positioned on the network path captures the unencrypted request. 4. The attacker extracts the JWT from the `Authorization` header. 5. Before the token expires, the attacker replays it against authenticated endpoints such as: - `/api/dashboard/summary` - `/api/positions` - `/api/deliveries` - `/api/settlements` - `/api/invento ...[truncated 1185 chars]
Remediation: ## Remediation Suggestions 1. Serve the API exclusively through HTTPS using TLS 1.2 or later. 2. Replace every `http://100.102.77.110:8013` reference with a certificate-backed HTTPS endpoint. 3. Redirecting HTTP to HTTPS is insufficient for bearer-token requests; reject plaintext requests before credentials can be transmitted. 4. Ensure clients validate the server certificate and hostname. Do not disable certificate verification. 5. Use an internal certificate authority if the API is private, and distribute its trust anchor securely. 6. Continue using short token lifetimes, but also scope tokens to the minimum role, audience, endpoints, and operations required. 7. Prefer manager credentials over administrator credentials unless administrator access is strictly necessary. 8. Consider token rotation, replay detection, and sender-constrained credentials where supported. 9. Revoke or rotate tokens and signing material if there is evidence that plaintext traffic has been captured. 10. Add deployment tests that reject configurations containing plaintext API URLs for authenticated requests.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill advertises that marketing data requires authentication, yet documents several unauthenticated integration endpoints that expose revenue, entities, acres, settlements, and dashboard marketing summaries. This creates an information disclosure risk because an agent or user may rely on the stronger access-control claim while sensitive business data remains accessible without a token.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation gives conflicting security guidance: it says marketing access requires manager/admin roles, but later instructs use of unauthenticated endpoints for summary and revenue data. In practice, this inconsistency can cause accidental oversharing, misuse by downstream agents, and a false sense that all marketing data is access-controlled when some of it is not.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill instructs operators to obtain JWTs from a local helper and send them in requests to access contracts, deliveries, inventory, and revenue data, but it provides no explicit warning about handling secrets or sensitive business information. In an agent setting, that omission increases the chance of token leakage through logs, transcripts, shell history, or insecure reuse of privileged credentials.