T09 · Insecure Skill Coding Practices
Error
- Location
scripts/config-manager.js:7- Finding
Provider API Keys Can Be Persisted in Plaintext Configuration Files
- Content
View full analysis
- Remediation
View remediation
Security audit
TeamWork
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its teamwork purpose, but it needs Review because it can persist provider API keys in plaintext and broadly share task context across configured models.
Install only if you are comfortable with local persistent provider configuration. Prefer environment-variable references instead of pasting real API keys, review .trae/config/providers.json permissions, avoid sharing confidential tasks with multiple external providers, and restrict template names to known bundled templates.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
utils/template-renderer.js:6- Finding
Template Path Traversal Allows Arbitrary Local File Reads
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The code does not create, orchestrate, or manage AI agent teams or collaborative workflows. Instead, it manages configuration data for model providers, models, pricing, quotas, and budgets. While this could support a broader teamwork system, the supplied code chunk’s actual primary purpose is configuration administration, not multi-agent task execution or team coordination. Therefore the declared description materially misrepresents the behavior of this code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code is an initialization module, not a runtime team-management system. It creates directories and reads/writes local JSON config files for providers, roles, and model scoring metadata. While the default role definitions relate conceptually to agent teams, the chunk does not dynamically create teams, assign agents, coordinate collaboration, or execute complex projects. Its primary purpose is setup and validation of configuration state, which is materially narrower and different from the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code does not perform dynamic team creation or management. Instead, it maintains a score database for models, updates evaluation metrics across dimensions, computes overall scores, tracks historical role fit, and retrieves top-ranked models for roles or capabilities. While role-fit and capability ranking could support a broader team-selection system, this chunk itself is focused on scoring and ranking models, not orchestrating multi-agent teams or executing complex collaborative workflows. Therefore the declared description materially overstates and misrepresents the actual behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents this skill as a multi-agent team orchestration component. However, the supplied code chunk only contains error classes plus helper functions to format/log errors and mark some errors as recoverable. There is no logic for creating agents, assigning roles, coordinating workflows, or executing complex projects. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a specialized capability for dynamic multi-agent team creation and management. However, the actual code chunk contains only general-purpose helper functions. None of the functions implement agent orchestration, team lifecycle management, specialized role handling, or coordinated workflows. While helper utilities could support a larger system, this code by itself does not match the declared primary purpose and instead serves as a generic utility library, making the description materially inaccurate for this chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a high-level orchestration skill for dynamically creating and managing AI agent teams. However, the supplied code chunk does not implement any agent-management or workflow-coordination behavior. It only aggregates and re-exports utilities from other local modules. This is a materially different primary purpose from the declared functionality, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill manages AI agent teams and coordinates complex multi-agent workflows. The supplied code does none of that. Instead, it defines a Logger class with log levels, console output, and optional file-based logging via fs.appendFileSync. This is a materially different primary purpose. Additionally, the code accesses filesystem resources for log writing, which is not suggested by the declared permissions or purpose. This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose suggests orchestration of AI agents, role assignment, and coordinated workflow management. However, the supplied code chunk only provides a basic template renderer that reads template files, substitutes variables and simple control blocks, and writes rendered content to an output path. This is a materially different primary purpose. The filesystem access for reading templates and writing output is also not reflected in the declared permissions, though the stronger issue is that the code is unrelated to multi-agent collaboration functionality.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const configManager = require('./scripts/config-manager.js');
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const configManager = require('./scripts/config-manager.js');
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const TeamCoordinator = require('./scripts/team-coordinator.js');
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const TeamCoordinator = require('./scripts/team-coordinator.js');
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const Herald = require('./scripts/herald.js');
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const Herald = require('./scripts/herald.js');
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const { createLogger, LOG_LEVELS } = require('./utils/logger.js');
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to add AI providers and API keys and describes persistent configuration files, but it provides no guidance on secure credential storage, redaction, or filesystem permissions. In a multi-agent skill that coordinates multiple providers, poor secret-handling practices increase the chance that API keys are stored in plaintext, exposed in logs, or made accessible to other components or users on the host.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states the skill is automatically invoked for broad conditions like 'multi-agent collaboration' or 'complex projects,' which creates an overly permissive trigger surface. In an agent framework, ambiguous auto-invocation can cause the skill to activate in contexts the user did not clearly intend, leading to unnecessary access to configuration, provider selection, or downstream execution logic.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs users to provide provider API keys and then persist provider configuration, but it gives no safeguards around secret collection, storage, masking, or use of environment variables. In a multi-provider orchestration skill, this creates a meaningful risk of credential exposure through files, prompts, logs, backups, or later configuration display.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill says it will display the complete provider configuration from
.trae/config/providers.json, which may include API keys or secret references. Exposing full configuration materially increases the chance of accidental credential disclosure to users, other models, logs, screenshots, or downstream tooling.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md { "name": "openai", "api_key": "${OPENAI_API_KEY}", "base_url": "https://api.openai.com/v1", "models": [ { "name": "gpt-4",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md { "name": "openai", "api_key": "${OPENAI_API_KEY}", "base_url": "https://api.openai.com/v1", "models": [ { "name": "gpt-4",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md { "name": "openai", "api_key": "${OPENAI_API_KEY}", "base_url": "https://api.openai.com/v1", "models": [ { "name": "gpt-4",
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow instructs the host model to present all task content, requirements, constraints, and background information to every participating model. In a multi-agent setting, this violates data minimization and can unnecessarily spread secrets, proprietary code, personal data, or internal business context across more providers/models than required.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The template explicitly states that no user consultation is required and that automated recovery will proceed, but it does not warn about possible side effects such as data loss, configuration drift, unintended actions, or service disruption. In a multi-agent teamwork skill that can coordinate complex workflows, this normalizes autonomous remediation without requiring a safety check or impact disclosure, increasing the chance of unsafe recovery actions being taken or socially justified by the generated report.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This skill documentation includes Chinese terms such as '订阅制' alongside English labels, and similar mixed-language labels appear elsewhere in the file. Because the skill does not state that it is region-specific or offer a language preference choice, this can violate a language/locale policy requiring user opt-in for non-default language presentation.
- Content
Static analysis
No suspicious patterns detected.