T09 · Insecure Skill Coding Practices
Error
- Location
flags.py:51- Finding
Unauthenticated Remote Feature-Flag Updates Over Arbitrary URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Feature Flags
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but its remote polling lets a configured endpoint change agent feature flags without authentication, validation, or clear trust limits.
Install only if you will keep polling disabled or point it at a trusted, authenticated HTTPS endpoint you control. Do not use these flags as the sole security gate for sensitive actions, and treat local load/save paths as user-controlled configuration operations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
flags.py:40- Finding
Contextual Feature Rules Use Unsafe Substring Matching
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python flag = self._flags.get(flag_name) if not flag: return False for rule in flag.get("rules", []): if context and self._evaluate_rule(rule, context): return rule.get("value", flag["default"]) rollout = flag.get("rollout", 1.0) if rollout < 1.0 and context: uh = hashlib.md5((flag_name+str(context.get("user_id",""))).encode()).hexdigest()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill describes capabilities that can read/write local files and perform network access, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the risk of over-broad execution because consumers cannot easily determine or enforce the minimum privileges the skill needs before use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The polling loop silently retrieves remote JSON and immediately merges it into active flags, with all exceptions suppressed and no user-facing disclosure. In a remote control plane for agent behavior, this creates an opaque configuration channel that can change runtime behavior without visibility, auditability, or integrity checks if the endpoint is compromised or misconfigured.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill promotes remote polling of a flag endpoint but does not warn users that agent context, usage patterns, or configuration data may be transmitted over the network. This can lead to unintentional data exposure or privacy issues, especially if polling is pointed at non-local or untrusted endpoints.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest describes a remote feature flag/toggle system, but the code also exposes generic local persistence operations to load and save flag state from arbitrary filesystem paths. While related to configuration management, local file read/write behavior goes beyond the manifest's stated remote-toggle emphasis.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill accepts an arbitrary polling URL and fetches data from it without any allowlist, scheme restriction, or trust validation. In an agent environment, this can enable unexpected outbound requests, including to attacker-controlled or internal endpoints, expanding the skill beyond simple feature toggling into a generic network fetch primitive.
- Content