T08 · Insecure Dependencies
Warning
- Location
references/ORGO_ACTION_PATTERNS.md:242- Finding
Unpinned Third-Party Package Installation from a Mutable Package Index
- Content
View full analysis
- Remediation
View remediation
Security audit
Orgo Desktop Control
Security checks for vulnerabilities and agentic risk
Overview
The skill openly provides Orgo cloud desktop control, including file transfer and remote execution, and the behavior fits its stated purpose.
Install this only if you intend to let an agent operate Orgo cloud desktops with your ORGO_API_KEY. Use a scoped key if available, approve destructive actions and local file uploads explicitly, avoid uploading secrets or broad directories, do not reuse the sample login credentials, handle VNC passwords carefully, and stop or delete remote computers when finished.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires internet access and uses a cloud SDK, but it does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens governance and makes it easier for an agent to invoke network-capable behavior without clear policy boundaries or review, increasing the risk of unintended remote actions and data movement.
- Content
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill explicitly supports file upload to a remote cloud computer, which creates a direct path for local data to leave the host environment. In a desktop-control skill this may be intended functionality, but without strong consent and path restrictions it can enable unauthorized exfiltration of sensitive local files to remote infrastructure.
- Content
Upload:
python client.upload_file("local.txt", ws.id, computer_id=computer.id)Export from VM:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The login-flow example embeds a literal username and password in documentation, normalizing insecure credential handling and creating a high risk that users will copy the pattern into real automation. In a remote desktop/browser-control skill, this is especially dangerous because the same code path can be used to access live third-party services, and hardcoded secrets may be committed to source control or leaked in logs/screenshots.
- Content
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 55% confidence
- Finding
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
- Content
md import urllib.request # 1. Upload a local file to the workspace client.upload_file("input.csv", ws.id, computer_id=computer.id) # 2. Process it on the VM computer.run_bash("python3 -c \""
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 55% confidence
- Finding
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
- Content
md import urllib.request # 1. Upload a local file to the workspace client.upload_file("input.csv", ws.id, computer_id=computer.id) # 2. Process it on the VM computer.run_bash("python3 -c \""
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python # Start the job in the background, write output to a log computer.run_bash("nohup python3 train.py > /tmp/train.log 2>&1 &") # Poll for completion import time
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This method executes arbitrary Bash commands on a cloud computer, which is a safety-critical operation. Although the method name and purpose imply execution, there is no explicit warning in the docstring or user-facing disclosure about the risks of running destructive commands or untrusted input.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The method sends arbitrary Python code for execution on the remote computer, which is a safety-critical action. The docstring describes behavior but does not warn that executing untrusted or destructive code can affect the remote system and its data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The method returns a VNC password, which is a sensitive credential, but the only disclosure is a terse docstring stating what it returns. There is no warning, confirmation, or explicit note that this exposes direct access credentials to the remote computer.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:213