T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package_json_linter.py:359- Finding
Unescaped Attacker-Controlled Values Enable Terminal and Markdown Report Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Package Json Linter
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward local package.json linter with no evidence of hidden network access, persistence, destructive actions, or credential handling.
Installers should treat this as a local linting helper. Run it only on project directories you intend to inspect, and prefer JSON output or careful review when linting untrusted repositories because text and Markdown reports may display crafted package metadata misleadingly.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md All commands use the bundled Python script at `scripts/package_json_linter.py`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md All commands use the bundled Python script at `scripts/package_json_linter.py`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md All commands use the bundled Python script at `scripts/package_json_linter.py`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md All commands use the bundled Python script at `scripts/package_json_linter.py`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md All commands use the bundled Python script at `scripts/package_json_linter.py`.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises shell and file-reading capabilities but does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an agent may invoke broader filesystem or shell access than reviewers and policy expect, increasing the risk of command execution against unintended paths or inputs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says to use the skill when asked to "lint, validate, audit, or check" package.json files and includes triggers such as "check package" and "validate npm." Phrases like "check package" and "validate npm" are ambiguous and broad enough to collide with everyday or unrelated package-management requests, with no negative examples or scope boundaries provided.
- Content
Static analysis
No suspicious patterns detected.