T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:28- Finding
JWT-Protected Workforce Data Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Farmos Workforce
Security checks for vulnerabilities and agentic risk
Overview
The skill is a workforce assistant with coherent goals, but it handles sensitive employee data and state-changing actions over under-scoped and insecure workflows.
Use this only in a controlled FarmOS environment after confirming HTTPS or equivalent private transport, authenticated employee-directory access, role enforcement, explicit confirmation before any write/approval/export, and clear notice before schedule details are posted to a shared channel. Treat payroll exports, manager tokens, employee roles, activity status, and GPS fields as sensitive data.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:45- Finding
Unauthenticated Employee Directory and Role Enumeration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to notify a shared #farm-workforce channel about time-off, absence, and swap requests without clearly warning users upfront that their information may be broadcast. This creates a privacy risk because personal scheduling details, and possibly volunteered reasons, may be disclosed more broadly than the user expects.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest frames the skill as a read-only workforce query tool, but the body authorizes write and approval actions such as clock-in/out, submitting requests, and approving timesheets. This mismatch can cause the skill to be invoked or trusted in contexts where users and calling systems expect only low-risk reads, enabling unintended state changes and approval actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Including payroll export capability expands the skill from routine workforce lookups into sensitive bulk data extraction. Even if intended for managers, exposing export functionality in a broadly described skill increases the chance of overbroad invocation, misuse, or unauthorized access to employee hour and payroll-adjacent records.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill claims it does not handle pay rates or compensation questions, yet it documents payroll exports and payroll-related access. This contradiction can mislead users, reviewers, or policy systems into underestimating financial data exposure and approving use in contexts that should be restricted.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger scope is extremely broad, covering common conversational phrases like schedule mentions or vague statements such as 'I need Friday off.' In a chat environment, this can cause unintended invocation and accidental logging or submission of workforce actions from casual conversation, especially because the skill also supports writes and notifications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill notes that time entries may include GPS coordinates but does not provide a clear warning about the sensitivity of location data or how it may be exposed during queries and summaries. Because location data is highly sensitive employee information, insufficient disclosure and handling guidance increase the risk of privacy violations and overexposure.
- Content
Static analysis
No suspicious patterns detected.