T09 · Insecure Skill Coding Practices
Error
- Location
pagerduty.js:13- Finding
Arbitrary API Endpoint Override Can Expose PagerDuty Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
PagerDuty Agent
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its PagerDuty management purpose, but it can send the PagerDuty API key to an arbitrary or unencrypted endpoint if an undocumented environment variable is set, and it can change live incident and alerting state.
Review this before installing in a production PagerDuty account. Keep PAGERDUTY_BASE_URL unset unless the code is changed to restrict it to HTTPS PagerDuty-controlled hosts, use a least-privilege API key, and require explicit human approval before commands that create, acknowledge, resolve, add notes, or create maintenance windows.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The maintenance-window command can suppress alerts for one or more services, but the documentation does not clearly warn that misuse can hide active incidents or prevent detection of new outages. In operational contexts, an agent could be instructed to create maintenance windows too broadly or at the wrong time, materially reducing monitoring visibility during real failures.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This function creates maintenance windows for services, which can suppress or alter operational alert handling, yet the code provides no visible warning, confirmation, or explanatory comment about the impact. Because this is a potentially disruptive and time-bounded operational change, users should be explicitly informed before it executes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill requires environment access to a PagerDuty API key and performs networked API operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens enforcement and review, making it easier for an agent platform or user to invoke sensitive capabilities without clear least-privilege boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill prominently advertises state-changing operations like triggering, acknowledging, and resolving incidents without a clear warning that these actions modify live production incident state. In an agent-driven workflow, that can lead to accidental incident creation, premature resolution, or workflow confusion when users assume the commands are informational.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code reads the PagerDuty API key from an environment variable and uses it to make outbound API requests, but provides no user-facing notice, confirmation, or explicit warning about transmitting data to PagerDuty. The header comment describes usage but does not disclose that incident details, notes, and service metadata will be sent to an external service using account credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill can trigger, acknowledge, and resolve incidents through POST/PUT requests, which are safety-relevant state changes, but there is no confirmation prompt, user-facing log, or warning comment describing these effects. The current file header only shows invocation format and does not warn that these commands will create or alter live incident state.
- Content