Back to skill

Security audit

Passport

Security checks for vulnerabilities and agentic risk

Overview

The skill is presented as a passport/identity validation tool, but its implementation is a broken plaintext logging and export utility for potentially sensitive identity data.

Do not use this skill with real passport numbers, identity records, names, dates of birth, or other sensitive personal data unless it is redesigned. It does not actually validate the data, and its documented workflow can retain or export plaintext inputs locally without strong safeguards.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:5
Finding

Plaintext Storage and Unsafe Export of Sensitive Identity Data

Content
View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash _export() { local fmt="${1:-json}" local out="$DATA_DIR/export.$fmt" case "$fmt" in json) echo "[" > "$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; txt) echo "=== Passport Export ===" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue echo "--- $(basename "$f" .log) ---" >> "$out" cat "$f" >> "$out" done ;; *) echo "Formats: json, csv, txt"; return 1 ;; esac echo "Exported to $out ($(wc -c < "$out") bytes)" } ``` ```bash check) shift if [ $# -eq 0 ]; then echo "Recent check entries:" tail -20 "$DATA_DIR/check.log" 2>/dev/null || echo " No entries yet. Use: passport check < ...[truncated 3263 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:122
Finding

Validation and Formatting Commands Provide No Processing and Fail at Runtime

Content
View full analysis
/dev/null || echo " No entries yet. Use: passport validate " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/validate.log" local total=$(wc -l < "$DATA_DIR/validate.log") echo " [Passport] validate: $input" echo " Saved. Total validate entries: $total" _log "validate" "$input" fi ;; ``` The same top-level `local` pattern and absence of actual processing occur throughout the handlers: ```bash generate) shift if [ $# -eq 0 ]; then echo "Recent generate entries:" tail -20 "$DATA_DIR/generate.log" 2>/dev/null || echo " No entries yet. Use: passport generate " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/generate.log" local total=$(wc -l < "$DATA_DIR/generate.log") echo " [Passport] ...[truncated 2254 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a passport/identity-document validation tool, but its documented behavior includes persistent logging, export, search, history, and generic developer-tool commands that materially expand its scope beyond validation. In the context of identity-document data, this mismatch is dangerous because users may provide highly sensitive PII believing the skill only performs local validation, while the tool also retains and surfaces that data through history, search, and export features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The advertised functionality claims passport or identity-document validation and formatting, but the implemented commands are just a generic logging toolkit. This mismatch is dangerous because users may submit highly sensitive identity data believing it will be processed locally for validation, when it is actually being retained and exposed through unrelated history and export features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Handlers named check, validate, generate, format, and lint only append raw user input to log files and echo it back, rather than performing the claimed operations. In the context of passport and identity-document workflows, this creates a high risk of collecting passport numbers, names, DOBs, and other PII under false pretenses, which can later be searched or exported in plaintext.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Automatic history and activity logging for passport workflows creates a privacy risk because users may enter passport numbers, names, dates of birth, or other document fields that are then retained without an explicit warning. In this context, silent retention of identity-document data increases the chance of unintended local disclosure, backup leakage, or later access by other users or malware on the same machine.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Describing automatic logging and history for operations on passport or identity-document data implies that sensitive inputs may be retained in logs. Even if storage is local, logs create a durable copy of PII that can be accessed by other local users, included in backups, or exposed after endpoint compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The storage section states that all data is stored locally and each action is logged, but it does not clearly warn that sensitive identity-document content may persist on disk. Because passport data is especially sensitive, omission of an explicit retention warning can mislead users into exposing regulated or confidential information to local files and backups.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented local storage and timestamped logging of all actions creates a concrete risk of retaining sensitive passport-related data in files under a predictable path. In the context of identity documents, such retention materially increases privacy and compliance risk even without network exfiltration.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The tool persistently records all inputs and provides bulk search, status, recent-history, and export functions that expose those inputs in plain language. Because the skill is framed around passports and identity documents, the stored material is likely to be highly sensitive PII, making this combination especially dangerous and more severe than it would be in a low-sensitivity domain.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script includes search, recent activity, stats, status, and export capabilities that are not justified by the stated passport-validation purpose. In a sensitive-document context, these generic data-harvesting and disclosure features materially increase the attack surface by making previously submitted identity data easier to enumerate, aggregate, and retrieve.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The export feature copies accumulated history into additional files without warning that prior submissions may contain sensitive identity information. This increases data proliferation and the likelihood of accidental disclosure, backup leakage, or unsafe sharing of exported plaintext files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

User-provided content is silently persisted to disk with no warning, despite the tool's identity-document theme making sensitive submissions likely. This lack of disclosure undermines informed consent and can cause users to expose passport or ID data that remains stored in plaintext on the host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The README-level claim at L017 says data never leaves the machine and the tool works entirely offline, but the same document later directs users to external web/contact endpoints at L098 and L100. While this does not prove the code transmits data, the documentation presents a contradictory intent signal about offline-only operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.