T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:35- Finding
JWT Credentials and Sensitive Farm Data Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Farmos Observations
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its farm-observation purpose, but it directs agents to send manager tokens, reports, and photos over unencrypted HTTP.
Review this skill carefully before installing. It should only be used on a trusted network or after the backend supports HTTPS, and users should require explicit confirmation before creating observations, tasks, maintenance entries, alerts, or photo uploads.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases and activation criteria are broad enough that ordinary conversation in shared channels could be interpreted as an instruction to engage the skill and potentially prepare or initiate writes. In this skill context, broad auto-detection is more dangerous because the skill can create authenticated observation records and branch into related operational workflows, increasing the chance of unauthorized or unintended actions from ambiguous chat.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 'What this does NOT handle' section says equipment maintenance scheduling or fleet status belongs to another skill. Yet later sections direct the agent to offer maintenance-related actions, log equipment issues against maintenance records, and cross-reference equipment maintenance history, which conflicts with the claimed scope boundary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This is an active contradiction within the documentation itself. One section excludes maintenance scheduling and fleet-status handling, while later sections direct behavior that touches maintenance records and equipment availability, creating clear intent-code-style divergence in the skill instructions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a skill for querying and creating field observations and AI-processed captures. However, the documented behavior instructs the agent to check other modules, correlate patterns, inspect equipment availability and maintenance history, and use weather/task context to drive recommendations, which materially broadens the skill from observation logging/querying into multi-system operational analysis.
- Content
Static analysis
No suspicious patterns detected.