Security audit

Service Catalog

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent service-catalog purpose, but its documented scan commands can expose secrets and can execute attacker-controlled code when run on a repository with crafted filenames.

Review before installing or using this skill on shared, third-party, or untrusted repositories. Run it only in a low-privilege, secret-free environment; avoid the raw Python snippets until filenames are passed as arguments safely; redact dependency and ownership output before sharing reports; and run live health checks only with explicit authorization.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:25
Finding: Repository-Controlled Filename Injection in Docker Compose Discovery
Content: View full analysis
/dev/null | while read f; do echo "=== $f ===" # Extract service names python3 -c " import sys in_services = False indent = 0 for line in open('$f'): stripped = line.rstrip() if stripped == 'services:': in_services = True continue if in_services: if stripped and not stripped.startswith(' ') and not stripped.startswith('#'): break ``` ### Technical Analysis The value of `f` originates from repository filenames discovered by `find`. It is interpolated directly into dynamically generated Python source: ```python open('$f') ``` Shell quoting does not make this safe at the Python parsing layer. A filename containing a single quote and valid Python syntax can terminate the string literal and alter the program executed by `python3 -c`. Repository filenames must therefore be treated as attacker-controlled input when scanning cloned repositories or submitted source archives. The use of `while read f` without `read -r` or null-delimited records also mishandles backslashes, whitespace, and newline characters in filenames. ### Attack Path 1. An attacker creates a directory or Compose filename containing quote characters and Python syntax. 2. The crafted path is committed to a repository or included in a source archive. 3. A user or Agent runs the documented `discover` procedure against that repository. 4. `find` assigns the crafted path to `f`. 5. The shell interpolates `f` into the source passed to `python3 -c`. 6. Python parses the injected text as code and executes it with the privileges of the scanning process. ### Impact ...[truncated 473 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:73
Finding: Repository-Controlled Filename Injection in package.json Discovery
Content: View full analysis
/dev/null | while read f; do HAS_START=$(python3 -c "import json; d=json.load(open('$f')); print('yes' if 'start' in d.get('scripts',{}) else 'no')" 2>/dev/null) if [ "$HAS_START" = "yes" ]; then NAME=$(python3 -c "import json; print(json.load(open('$f')).get('name','unknown'))" 2>/dev/null) echo "Node service: $NAME ($f)" fi done ``` ### Technical Analysis Both Python commands insert a repository-controlled path directly into a quoted Python expression. A malicious parent-directory name can contain characters that terminate the `open()` string literal and inject Python expressions or statements. The basename restriction to `package.json` does not prevent exploitation because its parent directories remain attacker-controlled. Suppressing standard error can also conceal syntax errors and exploitation attempts from the operator. ### Attack Path 1. An attacker places `package.json` below a directory whose name contains a crafted Python fragment. 2. The crafted directory and file are introduced into a repository scanned by the Skill. 3. The discovery loop receives the full path from `find`. 4. The path is substituted into one or both `python3 -c` commands. 5. The injected Python executes when service discovery evaluates the package metadata. ### Impact Assessment The attacker can execute code with the scanning user's permissions. Reachable resources may include source code, local configuration, environment variables, Agent credentials, writable repository files, and network services available from the scan environment. The commands are part of ordinary service discovery, making accidental invocation against an untruste ...[truncated 29 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:219
Finding: Repository-Controlled Filename Injection in Ownership Detection
Content: View full analysis
/dev/null | while read f; do python3 -c " import json d = json.load(open('$f')) name = d.get('name', 'unknown') author = d.get('author', 'unassigned') if isinstance(author, dict): author = author.get('name', 'unassigned') print(f'{name}: {author}') " 2>/dev/null done ``` ### Technical Analysis The ownership command repeats the same unsafe source-generation pattern. The untrusted path is embedded inside a multiline Python program without escaping. A quote in a repository-controlled parent-directory name can break out of the string passed to `open()` and introduce executable Python. JSON parsing is not the vulnerable operation; the vulnerability occurs before the file is parsed, while Python parses the dynamically assembled program. ### Attack Path 1. An attacker creates a `package.json` under a maliciously named directory. 2. The user invokes the `owners` procedure on the repository. 3. `find` emits the attacker-controlled path. 4. The path is inserted verbatim into the multiline Python source. 5. The Python interpreter executes the injected code with the scanner's authority. ### Impact Assessment Exploitation can result in arbitrary local command execution and compromise the confidentiality and integrity of all resources available to the scanning process. Potential consequences include repository tampering, credential theft, falsified ownership output, and lateral network access. No privilege escalation beyond the scanner's existing account is demonstrated. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:136
Finding: Credential-Bearing Configuration Values May Be Exposed in Scan Output
Content: View full analysis
/dev/null ``` ### Technical Analysis `rg -n` prints the complete matching line, including the filename, line number, and content. Connection strings such as `DATABASE_URL`, `REDIS_URL`, `RABBITMQ_URL`, and `MONGO_URI` frequently contain usernames, passwords, access tokens, query credentials, internal hostnames, or other sensitive deployment information. The declared catalog function needs dependency identifiers, not complete credential-bearing values. Printing complete lines therefore exceeds the minimum data exposure necessary for service dependency discovery. The output may subsequently be retained in terminal logs, Agent context, generated reports, CI logs, or chat transcripts. The separate health-check command only contacts literal localhost health endpoints and discards response bodies; the reviewed text does not establish that it transmits these configuration values over the network. The confirmed issue is local/log output exposure rather than demonstrated exfiltration. ### Attack Path 1. A scanned repository contains an environment file, manifest, or configuration file with a credential-bearing connection URL. 2. The user invokes catalog or dependency discovery. 3. `rg` matches the variable name and prints the entire source line. 4. The secret enters command output and may be copied into the Agent's context or catalog report. 5. Anyone with access to those logs, reports, or transcripts may recover and misuse the exposed credential. ### Impact Assessment Exposed credentials could provide access to databases, caches, message brokers, internal APIs, or ad ...[truncated 330 chars]
Remediation: View remediation
/dev/null | sort -u ``` If hostnames are required for dependency mapping, parse the value locally and emit only a validated hostname or service alias after removing user information and query parameters. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description frames the feature as routine service cataloging but does not warn that it can surface sensitive repository and infrastructure metadata such as internal service names, owners, dependency relationships, repository URLs, health endpoints, and deployment workflows. In environments where outputs may be shared broadly, this omission can lead users to disclose high-value internal mapping information unintentionally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises broad trigger phrases such as 'list all our services', 'map our infrastructure', and 'who owns this service', which can match ordinary user requests and cause the agent to invoke a powerful repository-wide enumeration workflow unexpectedly. Because the skill collects infrastructure, ownership, dependency, and health metadata, accidental invocation increases the chance of over-collection and disclosure of sensitive internal topology.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The health command goes beyond passive repository inspection by issuing live curl requests to discovered localhost health endpoints. In an agent context, this can probe locally running services and expose metadata or trigger side effects against internal admin or diagnostic endpoints that were not intended to be contacted during catalog generation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.