T09 · Insecure Skill Coding Practices
Warning
- Location
script.sh:70- Finding
Python Code Injection Through Unsafe Interpolation in Generated Submission Command
- Content
View full analysis
- Remediation
View remediation
Security audit
Awesome Submitter Pro
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly prints GitHub submission guidance, but it includes an unsafe copy-paste command that can run unintended code if filled with hostile text.
Review this skill before installing or using it. Its GitHub research links are expected for the stated purpose, but do not copy and run the generated URL-building bash/Python snippet with untrusted product names, titles, or body text; use a safer encoder that passes values as arguments instead.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 81% confidence
- Finding
The skill metadata declares no explicit tool restrictions even though static analysis detected shell and network-capable behavior. In an agent environment, missing scope boundaries can let the skill invoke broader capabilities than a user expects, which is risky for a marketing/SEO skill that could automate outbound requests or local command execution.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh open "https://github.com/search?q=awesome+KEYWORD&type=repositories&sort=stars" # Check if list is active curl -s "https://api.github.com/repos/OWNER/REPO" | \ python3 -c "import sys,json; d=json.load(sys.stdin); \ print(f'Stars: {d[\"stargazers_count\"]}'); \ print(f'Updated: {d[\"updated_at\"]}')"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh open "https://github.com/search?q=awesome+KEYWORD&type=repositories&sort=stars" # Check if list is active curl -s "https://api.github.com/repos/OWNER/REPO" | \ python3 -c "import sys,json; d=json.load(sys.stdin); \ print(f'Stars: {d[\"stargazers_count\"]}'); \ print(f'Updated: {d[\"updated_at\"]}')"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh open "https://github.com/search?q=awesome+KEYWORD&type=repositories&sort=stars" # Check if list is active curl -s "https://api.github.com/repos/OWNER/REPO" | \ python3 -c "import sys,json; d=json.load(sys.stdin); \ print(f'Stars: {d[\"stargazers_count\"]}'); \ print(f'Updated: {d[\"updated_at\"]}')"
Static analysis
No suspicious patterns detected.