T09 · Insecure Skill Coding Practices
Error
- Location
salute_transcribe.py:29- Finding
TLS Certificate Verification Disabled for Sensitive API Traffic
- Content
View full analysis
- Remediation
View remediation
Security audit
salute speech
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its transcription purpose, but it sends API credentials and audio to Sber with SSL certificate checks disabled by default.
Review before installing. Use only with media you are allowed to send to Sber's service, protect SALUTE_AUTH_DATA, prefer a version that enables SSL verification or supports a trusted CA bundle, and treat the saved JSON/transcript files as sensitive content.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:43- Finding
Unpinned Dependency Resolved and Installed at Runtime
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill performs sensitive actions—reading credentials from the environment, writing files, and sending data over the network—but does not declare any explicit tool scope or permission boundaries. This increases the chance of overbroad execution in agent environments and makes the skill's actual capabilities less transparent to reviewers and users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description says it transcribes files via an async REST API but does not clearly warn that user audio/video content is uploaded to a third-party service. Users may unknowingly send sensitive conversations, personal data, or regulated content off-host, creating privacy, compliance, and data handling risks.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Disabling SSL certificate verification by default removes server identity validation for the API connection. An attacker positioned on the network could intercept credentials and uploaded audio, alter responses, or impersonate the transcription service, which is especially dangerous because the skill transmits authentication material and potentially sensitive recordings.
- Content
md ## Requirements - **API Key**: Environment variable `SALUTE_AUTH_DATA` must be set (Base64-encoded `client_id:client_secret` or raw authorization key from https://developers.sber.ru/studio/). - **SSL note**: The script disables SSL verification by default (`verify_ssl=False`) because Sber's certificate chain is non-standard. This is expected. ## Supported formats & encodings
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill stores raw JSON recognition output and formatted transcripts on disk, but the description does not warn that these files may contain sensitive speech content, timestamps, confidence data, and metadata. This can lead to inadvertent local data exposure, especially in shared workspaces or long-lived directories.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
SSL certificate verification is disabled by default for all outbound API requests, which enables man-in-the-middle attacks against token exchange, file upload, task polling, and result download. An attacker on the network path could intercept credentials, bearer tokens, audio content, or tamper with transcription responses.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
An insecure default that disables certificate verification weakens all network interactions out of the box, even for users who do not realize they are operating in unsafe mode. In this skill, the context increases danger because bearer tokens, API credentials, and potentially sensitive audio/transcripts are all transmitted to remote services.
- Content
python self, auth_data: str | tuple[str, str], scope: str = "SALUTE_SPEECH_PERS", verify_ssl=False ): """ Инициализация клиента
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ] try: response = requests.post( self.recognize_url, headers=headers, json=payload,
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 55% confidence
- Finding
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
- Content
python self.get_access_token() # Шаг 2: Загрузка файла request_file_id = self.upload_file(audio_file_path, content_type) # Шаг 3: Создание задания task_id = self.create_recognition_task(
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool uploads user-provided media to an external cloud transcription service without an explicit runtime warning or consent flow, creating a privacy and data-handling risk. In a transcription skill this behavior is expected, but it is still dangerous when users may process sensitive recordings without clear notice of network transmission and third-party processing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file's natural-language interface and documentation strings are primarily in Russian, and the transcription language also defaults to ru-RU. While alternative recognition languages are supported, the user-facing messaging does not offer locale choice and may impose a specific language by default.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes an audio transcription skill, while the CLI description and --file help text explicitly claim support for audio/video files, and the program always saves JSON and text outputs locally. Local file output may be useful, but the broader advertised behavior goes beyond the manifest's narrower description of transcribing audio files.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The code accesses the sensitive environment variable SALUTE_AUTH_DATA and uses it to authenticate against a remote API. While this is functionally necessary, there is no visible warning or documentation in this file telling users that they must supply and protect credentials for external service access.
- Content
Static analysis
No suspicious patterns detected.