T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kya_receipt.py:157- Finding
Unauthenticated control evidence can be converted into a signed authorization receipt
- Content
View full analysis
- Remediation
View remediation
Security audit
KYA Regulated Agent Human Gate
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent and not deceptive, but its bundled receipt issuer can sign financial authorization receipts from unverified approval evidence, so it needs careful review before use.
Install only as a design and testing aid. Do not use the bundled Python receipt issuer as a production authorization service unless evidence verification, approver independence, caller authentication, KMS/HSM signing, and strict permission boundaries are added outside the agent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kya_receipt.py:176- Finding
Independent human approval does not enforce approver independence or authority
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Test audit completeness against `templates/audit-log-schema.json`. Protect event integrity with canonicalization, an append-only destination, access control, retention rules, and a managed signature or timestamping mechanism. A local hash chain alone does not prove immutability. Do not store full identity documents, raw biometrics, full account numbers, passwords, access tokens, secrets, or private keys in action intents, receipts, or audit logs.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill references environment variables and local file reads/writes (for example, setting
KYA_RECEIPT_SECRET, reading templates/resources/examples, and writingreceipt.jsonand a nonce DB) but does not declare an explicit tool/permission scope. That creates an authorization ambiguity where an agent or runtime may grant broader filesystem or environment access than reviewers expect, which is especially sensitive in a regulated-finance workflow handling approval receipts and audit artifacts.- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This JSON file is within the manifest-file scope for vague-trigger review, but it contains only structural data definitions and no explicit activation phrases, contexts, or exclusion conditions. If this file is used as part of skill registration or invocation metadata, the absence of any trigger specification leaves the activation boundary undefined.
- Content