T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/circleci_config_validator.py:643- Finding
Terminal and CI Log Output Injection Through Unescaped Configuration Values
- Content
View full analysis
- Remediation
View remediation
Security audit
Circleci Config Validator
Security checks for vulnerabilities and agentic risk
Overview
This is a local CircleCI config validator with no hidden network access or persistence, though untrusted config content could affect its terminal text output.
Reasonable to install for local CircleCI config checks. Use extra caution when validating configs from untrusted pull requests: prefer JSON output or review raw output carefully until terminal-control escaping is added. Publishers should add explicit tool/path scope metadata and sanitize human-readable output.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises file-processing behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope metadata can cause the skill to be invoked with broader-than-necessary file access assumptions, weakening least-privilege controls and making unintended file reads harder to govern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description says to use the skill when 'validating CircleCI pipeline configuration' or 'checking CircleCI config for common mistakes,' which are broad natural-language triggers without explicit boundaries or exclusion conditions. Although CircleCI is domain-specific, the file does not clearly define exact trigger phrases or when the skill should not activate.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This code performs file access by opening the user-supplied path, which is one of the safety-relevant operations covered by the warning requirement for code files. While the module docstring says it validates CircleCI config files, there is no inline confirmation prompt needed here, but there also is no localized disclosure at the point of file read other than generic naming, so the warning is minimal.
- Content