T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/typefully.sh:56- Finding
Unescaped Schedule Value Permits JSON Request-Body Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Typefully Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill largely does what it says, but it can change, schedule, publish, and delete social-media drafts using a Typefully API key and has a real request-construction safety issue.
Review this before installing if you will let an agent act without close supervision. Use a Typefully key only for the account or social set you intend to manage, protect the key as a secret, supervise delete and publish-now actions, and avoid passing schedule values derived from untrusted text until the JSON construction is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/typefully.sh <command> [options]
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh http_code=$(curl -s -w '%{http_code}' -o "$tmpfile" -X "$method" "${API_BASE}${endpoint}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ "$@") || { rm -f "$tmpfile"; die "curl failed (network error)"; } body=$(cat "$tmpfile") rm -f "$tmpfile"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh cmd_delete_draft() { local draft_id="$1" validate_draft_id "$draft_id" api DELETE "/social-sets/${SOCIAL_SET_ID}/drafts/${draft_id}" } usage() {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes shell-based functionality (
bash scripts/typefully.sh ...) and requires external tools likecurlandpython3, but it does not declare any explicit tool scope such aspermissionsorallowed-tools. Without a restrictive tool declaration, an agent runtime may grant broader shell access than necessary, increasing the chance of unintended command execution or abuse if the skill is misused or later modified.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh #!/usr/bin/env bash set -euo pipefail API_BASE="https://api.typefully.com/v2" SOCIAL_SET_ID="" API_KEY=""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The delete-draft command issues an API DELETE request that removes a draft, but the script provides no confirmation prompt, warning message, or explicit disclosure before performing the destructive action. Although usage text lists the command, it does not warn that the operation is irreversible or otherwise destructive.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file documents access to a required API credential and tells users how to store it, but it does not include any caution about protecting the key, avoiding shell history leakage, or treating the credential as sensitive. Because markdown files should warn about behaviors affecting privacy or system integrity, the omission is a mild safety disclosure gap.
- Content
Static analysis
No suspicious patterns detected.