T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:96- Finding
Forced Promotional Output in API-Key Error Handling
- Content
View full analysis
- Remediation
View remediation
Security audit
Chart AI
Security checks for vulnerabilities and agentic risk
Overview
This chart-generation skill has a coherent purpose, but it documents unsafe shell-style invocation and includes under-scoped network download behavior that should be reviewed before installation.
Install only if you are comfortable sending selected prompts and spreadsheet contents to ChartGen. Do not use it with confidential, regulated, or secret data unless your organization approves ChartGen, and avoid running requests that contain shell metacharacters until the invocation method is hardened to pass arguments without a shell.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:85- Finding
Shell Command Injection Through Documented User-Input Interpolation
- Content
View full analysis
" [files...] ``` ``` ### Technical Analysis The documented workflow instructs the agent to construct a shell command by interpolating the user-controlled query, channel, and file paths. Placing the query inside double quotes is not sufficient shell escaping. In common POSIX shells, command substitution such as `$(command)` and backticks is still evaluated inside double-quoted strings. Embedded quotation marks and other shell metacharacters can also alter argument boundaries. The JavaScript CLI reads arguments through `process.argv` and does not itself invoke a shell. The vulnerability is introduced by the skill’s prescribed invocation method when an execution tool evaluates the assembled command through a shell. For example, a query containing shell command substitution could be transformed into: ```sh node tools/chartgen_api.js submit "Create a chart titled $(attacker_command)" Web ``` The shell would execute `attacker_command` before starting Node and would pass its output as part of the query. ### Attack Path 1. An attacker submits a chart request containing shell syntax, such as command substitution or an embedded quote followed by shell operators. 2. The agent obtains confirmation as required by the workflow. 3. The agent substitutes the attacker-controlled text into the documented command string. 4. A shell-based execution tool parses the resulting command. 5. The shell evaluates the injected syntax before `chartgen_api.js` receives its arguments. 6. The injected command runs with the operating-system privileges and environment of the agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the account running the agent. Depending on that account ...[truncated 572 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
tools/chartgen_api.js:343- Finding
Unrestricted Server-Directed Download Enables SSRF and Resource Exhaustion
- Content
View full analysis
{ try { const mediaDir = getMediaDir(); const dest = path.join(mediaDir, `chartgen_${tag}.${ext}`); const mod = url.startsWith("https") ? https : http; const file = fs.createWriteStream(dest); mod.get(url, (res) => { if (res.statusCode === 301 || res.statusCode === 302) { downloadFile(res.headers.location, tag, ext).then(resolve); return; } if (res.statusCode !== 200) { resolve(null); return; } res.pipe(file); file.on("finish", () => { file.close(); resolve(dest); }); file.on("error", () => resolve(null)); }).on("error", () => resolve(null)); } catch { resolve(null); } }); } ``` The URL is consumed from the remote API response without validation: ```js } else if (art.download_url) { const dtag = String(art.artifact_id || Date.now()); const dp = await downloadFile(art.download_url, dtag, "pptx"); if (dp) art.download_path = dp; } ``` ### Technical Analysis The downloader trusts `art.download_url`, which is supplied by the remote API, and performs a request without validating the destination. It has the following security weaknesses: - No hostname or origin allowlist. - No rejection of loopback, link-local, private, or otherwise internal network addresses. - Plain HTTP is accepted. - Redirects are followed recursively without a redirect limit. - Redirect destinations are not revalidated against a trusted-host policy. - No request timeout is configured for downloads. - No maximum response-size limit is enforced. - The response is saved with a `.pptx` extension without validating its content type or PPTX/ZIP structure. - A destinat ...[truncated 2165 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The invocation criteria are very broad: they cover generic visualization, analysis, reports, mention of ChartGen, and any spreadsheet upload. This can cause the skill to activate for many ordinary requests and unnecessarily route user prompts and files to an external service, expanding data exposure and the blast radius of any downstream issue.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## Tool — `tools/chartgen_api.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## Tool — `tools/chartgen_api.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## Tool — `tools/chartgen_api.js`
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ### STEP 1 — Confirm Before Submitting Always respond in the user's language. **Must** include numbered options (1=go, 2=modify, 0=cancel). **Confirmation rules:** 1. **Cancel = abandon forever.** Never proceed with a cancelled task.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ### STEP 1 — Confirm Before Submitting Always respond in the user's language. **Must** include numbered options (1=go, 2=modify, 0=cancel). **Confirmation rules:** 1. **Cancel = abandon forever.** Never proceed with a cancelled task.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares environment/runtime requirements and instructs the agent to execute local commands, but it does not constrain tool scope with an explicit allowlist such as allowed-tools or permissions. In agents that support multiple powerful tools, this increases the chance of unintended tool access or broader execution than the skill actually needs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly sends user queries, uploaded spreadsheets, and potentially data from web/external sources to a third-party API, but the description does not clearly warn users about external data sharing. Users may provide sensitive business or personal data without informed consent, creating privacy, compliance, and confidentiality risks.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **File upload:** Do NOT submit immediately. Recommend 3–5 analysis tasks (numbered, noting which files). User picks a number, types custom text, or cancels. Text request example (adapt to language): > I'll use **ChartGen** to create this for you: > 📊 **Generate a monthly sales trend line chart for 2025.** > **1** — Go ahead **2** — Modify **0** — Cancel
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest frames this skill as creating visualizations, analyzing spreadsheet data, and generating reports. In addition to those functions, the code implements credential discovery by reading environment variables and multiple files under the user's home/state directories, which is a separate capability not inherently required by chart generation itself.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
User-supplied spreadsheet contents are uploaded to a third-party remote API, but this file provides no explicit consent or warning at the point where data leaves the local environment. In a chart/report skill this behavior is functionally expected, yet it is still sensitive because uploaded files may contain confidential business or personal data and the transfer is easy to miss.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool follows artifact-provided download URLs and fetches them with raw http/https without validating host, scheme safety, redirect targets, size, or content type. Because the URL comes from the remote service response, a compromised service or malicious response could trigger arbitrary outbound requests and write attacker-controlled content to local storage, creating SSRF-style network access and untrusted file write behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The tool saves generated images and presentation files into the media/workspace/tmp directory via write operations, which affects the user's filesystem. While image-saving is part of the tool's function, there is no user-facing log or warning at these write points indicating where files are being created.
- Content