T09 · Insecure Skill Coding Practices
Error
- Location
examples/interleaved-thinking/reasoning_trace_optimizer/cli.py:183- Finding
Unrestricted API Endpoint Can Receive Authentication Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Skills Context
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed context-engineering collection, but it includes high-impact example patterns that can expose credentials or sensitive agent traces if reused without safeguards.
Install only if you are comfortable treating this as a broad agent-engineering reference collection. Do not run the reasoning-trace optimizer on private sessions, customer data, credentials, or proprietary repositories unless you first add redaction and verify the endpoint receiving the data. Do not copy the hosted-agent shell-command examples as written; use argument-array subprocess calls, scoped short-lived credentials, endpoint allowlists, and explicit user controls for sandboxing, snapshots, generated skills, and background agents.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/interleaved-thinking/reasoning_trace_optimizer/analyzer.py:177- Finding
Complete Reasoning Traces and Tool Data Are Transmitted Without Redaction
- Content
View full analysis
str: """Format thinking blocks for analysis.""" parts = [] for i, thinking in enumerate(trace.thinking_blocks): parts.append(f"[Turn {thinking.turn_index}] Thinking:") parts.append(thinking.content) parts.append("") return "\n".join(parts) def _format_tool_calls(self, trace: ReasoningTrace) -> str: """Format tool calls for analysis.""" if not trace.tool_calls: return "No tool calls made." parts = [] for tc in trace.tool_calls: status = "Success" if tc.success else f"Failed: {tc.error}" parts.append( f"- {tc.name}({json.dumps(tc.input)}) -> {status}\n" f" Result: {tc.result[:200] if tc.result else 'None'}..." ) return "\n".join(parts) ``` ### Technical Analysis The analyzer constructs an outbound model request containing: - The original task - The agent's system prompt - Every captured reasoning block - Full serialized tool-call inputs - Tool-result excerpts - The final response - Error details No s ...[truncated 1875 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/hosted-agents/references/infrastructure-patterns.md:43- Finding
Shell Command Injection and Token Exposure in Hosted-Agent Infrastructure Pattern
- Content
View full analysis
dict: """Execute a prompt in the sandbox.""" # Update git config for this user os.system(f'git config user.name "{user_identity["name"]}"') os.system(f'git config user.email "{user_identity["email"]}"') ``` ### Technical Analysis The reference implementation inserts a repository URL, GitHub token, user name, and email address directly into shell command strings passed to `os.system()`. `os.system()` invokes a command shell, so shell metacharacters and substitutions in interpolated values are interpreted as executable syntax. Quoting the identity values with double quotes is insufficient. Values containing a double quote, command substitution, backticks, newlines, or other shell syntax can escape the intended argument and execute arbitrary commands. The GitHub token is also embedded directly in the clone URL. This can expose it through process listings, command logging, exception output, shell history, telemetry, or build records. The affected content is a reference implementation rather than an active call path in the current package. Exploitation therefore requires the pattern to be copied, adapted, or deployed as shown. Because the document presents the code as an infrastructure pattern, it can propagate the flaw into production systems. ### Attack Path 1. A hosted-agent deployment adopts the documented implementation. 2. An untrusted user ...[truncated 1366 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (386)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about agent-system engineering skills, especially context management, multi-agent architectures, and production debugging. The supplied code is instead focused on preparing supervised fine-tuning data from books, including chunking text, generating prompts/instructions, formatting message-based training examples, building token/weight training records, and checking for memorization. These are materially different primary purposes. There is no meaningful evidence in the code of context engineering for agents, multi-agent orchestration, or production agent system tooling. While both relate broadly to LLM workflows, the actual code's core capability is an SFT dataset pipeline, which is undeclared and unrelated to the stated skill description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skillset is for context engineering, multi-agent architectures, and production agent systems. The supplied code instead implements a content-ideas generator for a 'digital brain' workflow: it loads posts/bookmarks/ideas from local files, scores engagement, filters bookmarks by category, and outputs writing prompts and suggestions. That is a materially different primary purpose from building or debugging agent systems. The file/resource usage and functional behavior are unrelated to the declared agent-context-management description, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description says this skill is a comprehensive collection of agent-system skills for context engineering, multi-agent architectures, and production agent systems. The supplied code chunk does not implement agent-building, optimization, debugging, orchestration, or context-management functionality. Instead, it performs a content-writing task: it loads idea/bookmark/post data from local JSONL files and outputs a markdown draft template based on a chosen idea. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about agent-system engineering skills: context management, multi-agent architectures, and production agent optimization/debugging. The supplied code does something materially different: it analyzes a local contacts dataset (
network/contacts.jsonl) to identify stale personal/professional contacts and generate an outreach report. This is not a supporting implementation detail of context engineering or agent architectures; it is an unrelated personal CRM/social network maintenance utility. No special permissions are declared, but the core mismatch is in purpose and accessed resource domain, not permissions.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description suggests a toolkit for agent-system engineering: context management, multi-agent architectures, and production agent optimization/debugging. The supplied code does not implement agent-building utilities, context engineering mechanisms, orchestration, debugging aids, or production-agent infrastructure. Instead, it loads JSONL records from specific local directories ('content', 'network', 'operations'), filters them by date, summarizes activity, and produces a weekly review document. This is a materially different primary purpose and accesses domain-specific resources not implied by the description. Therefore, the description does not accurately represent the code chunk's behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description says this skill collection is for context engineering, multi-agent architectures, and production agent systems. The supplied code does not implement those capabilities; instead, it is an installation script for a different-seeming 'digital-brain' skill. Its primary behavior is local filesystem installation and replacement of directories, plus setup instructions for personal voice/brand/contacts/ideas. Those behaviors are materially different from the declared purpose, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad skill collection for context engineering, multi-agent architectures, and production agent systems. The supplied code chunk does not implement such a collection or those capabilities directly. Instead, it is an example/demo script focused on observing interleaved reasoning during tool use in a weather comparison task. Its primary behavior is trace capture and analysis around mock tool calls, plus external model API usage, which is materially different from the declared purpose. While trace/agent-related tooling is loosely adjacent to agent systems, this specific code is much narrower and does not accurately represent the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents this as a broad skill collection for context engineering, multi-agent architectures, and production agent systems. The supplied code chunk is instead a concrete example program focused on optimizing a research agent prompt using interleaved-thinking traces and simulated tools. Its primary behavior is operational: execute a multi-iteration optimization loop, use tool executors for web/file/note actions, save artifacts, and generate a shareable skill. While this is related to agent optimization and context management at a high level, it is materially narrower and different in purpose than a general skill collection, and it includes undeclared behaviors like file writing, artifact generation, and external API-backed optimization.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents this as a broad collection of existing Agent Skills focused on context engineering, multi-agent architectures, and production agent systems. The supplied code instead is a narrow code utility for generating new skill documents from reasoning-trace optimization outputs. Its primary behavior is programmatic skill generation via an external model API and filesystem writes, which is materially different from being a reusable collection of skills for agent-system context management. The external network use and artifact persistence are also undeclared capabilities in the description. Therefore, this chunk does not accurately represent the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad, comprehensive skillset for context engineering and multi-agent/production agent systems. The actual code chunk does not implement or expose such functionality; it merely identifies a tests package for a 'Reasoning Trace Optimizer.' Even allowing for partial snippets, this code's apparent purpose is test organization for a specific feature, which is materially narrower and different from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill provides agent-related capabilities for context engineering and multi-agent production systems. However, the supplied code chunk only configures ESLint and TypeScript linting behavior. It does not implement agent logic, context management, orchestration, debugging workflows, or any runtime skill behavior matching the description. This is a material purpose mismatch rather than a minor supporting detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description focuses on context engineering, multi-agent architectures, and production agent systems. The supplied code chunk instead demonstrates a basic evaluation workflow: it creates an EvaluatorAgent, evaluates a response using scoring criteria and a rubric, and outputs strengths, weaknesses, and scores. This is a materially different primary purpose from the declared one. There is no evidence here of context management, multi-agent orchestration, or debugging/optimization of agent systems. The code’s API key/config validation is a supporting detail and not the basis for the mismatch; the mismatch is the core functionality being response evaluation rather than the declared agent-systems skill set.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description centers on agent-system engineering, context management, and multi-agent architecture skills. The supplied code instead implements an evaluation workflow for judging model outputs using an EvaluatorAgent. Its primary purpose is assessment of text responses via rubric generation, scoring, and comparison, which is materially different from context engineering or production agent system optimization/debugging. There is no evidence in this chunk of context-management or multi-agent orchestration behavior. This is therefore a clear description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description focuses on agent-system engineering, context management, multi-agent architectures, and production agent debugging. The supplied code chunk instead demonstrates rubric generation for evaluation purposes via an EvaluatorAgent. Its primary function is to create and display scoring levels, guidelines, and edge cases for a review criterion, which is materially different from context engineering or multi-agent system support. There is no indication in this code of context management, orchestration of multiple agents, or debugging/optimization of production agent systems. Therefore the description does not accurately represent this code chunk's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description centers on context engineering, multi-agent architectures, and production agent systems for effective context management. The supplied code instead defines an evaluation-focused agent whose core purpose is judging AI-generated content via scoring, comparisons, and rubric generation. This is a materially different primary purpose, not just an implementation detail. While both may exist within a broader agent-related repository, this specific code chunk does not implement context management or multi-agent architecture functionality; it implements evaluation capabilities that are undeclared in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description claims a broad, comprehensive skill set for context engineering, multi-agent architectures, and production agent systems. The actual code shown is a minimal barrel export file that exposes evaluator-agent symbols from another module. Based on this chunk alone, the behavior is much narrower and centered on evaluator agent exports, with no visible implementation of context management, multi-agent orchestration, optimization, or debugging capabilities. This is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The supplied code chunk is a narrow configuration module: it imports environment variables, exposes OpenAI/Anthropic config values, and throws an error if OPENAI_API_KEY is missing. That behavior does not match the declared purpose of a comprehensive collection of agent skills for context engineering, multi-agent architectures, or production agent systems. While configuration can be a supporting detail in a larger system, this specific chunk's primary behavior is environment-based API configuration, which is materially different from the declared functional description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description emphasizes context engineering, multi-agent architectures, and production agent systems for context management. However, the supplied code chunk is an index file for an evaluation-oriented package: it exports tools and types such as DirectScore, PairwiseCompare, and GenerateRubric, which indicate LLM-as-judge assessment functionality. That is a materially different primary purpose from context management or agent-system architecture support, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about a broad skill collection for context engineering and multi-agent/production agent system development. The supplied code chunk instead implements a narrow evaluation utility for directly scoring an LLM response against criteria using an OpenAI model. This is a materially different primary purpose. The code does not demonstrate context engineering, multi-agent orchestration, or debugging agent systems; it performs response assessment. There are no declared permissions, and while the code uses an external model API, the main mismatch is purpose and capability rather than permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents the skill set as focused on context engineering, multi-agent architectures, and production agent systems. The supplied code instead defines a narrowly scoped evaluation utility that calls an OpenAI model to generate JSON rubrics for scoring criteria. Its primary purpose is rubric generation for LLM-as-judge/evaluation workflows, not context management or multi-agent system design/debugging. It also introduces an external model invocation capability that is not suggested by the declared permissions or description. This is a material purpose mismatch, not just an implementation detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill collection is for building, optimizing, or debugging agent systems with effective context management, especially around context engineering and multi-agent architectures. However, the supplied code chunk only re-exports evaluation utilities for scoring and comparing outputs and generating rubrics, which are characteristic of an LLM evaluation/judge toolkit. That is a materially different primary purpose from context management or multi-agent system engineering, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description is broad and focused on context engineering, multi-agent architectures, and production agent system support. The supplied code chunk instead provides a narrow 'LLM-as-judge' evaluation utility for pairwise comparison of responses. Its primary purpose is judging outputs, not managing context, orchestrating multiple agents, or debugging production agent systems. It also makes an external OpenAI call, which is not suggested by the declared purpose. This is a material description-behavior mismatch rather than a minor implementation detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description centers on context engineering, multi-agent architectures, and production agent systems for effective context management. However, the supplied code chunk does not implement or test context-management or multi-agent orchestration skills. Instead, it tests an evaluation framework where model responses are scored, compared, and judged, including rubric generation and chat-based evaluation. That is a materially different primary purpose from the declared one, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a functional skill collection for agent-system design and context engineering. The supplied code chunk does not implement agent skills, context management, or multi-agent architecture behavior. Instead, it performs generic test harness setup for a test suite. This is a materially different primary purpose, not merely a supporting detail of the declared functionality, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about agent-system engineering skills: context engineering, multi-agent architectures, and production agent systems. The actual code chunk instead contains tests for evaluation-related skills based on LLM-as-a-Judge research. Its core functions are scoring responses, comparing two responses, generating grading rubrics, and validating output schemas. While one test mentions using provided context, that is only a parameter in evaluation and does not make the skill primarily about context engineering or multi-agent architecture. Therefore the code’s primary purpose is materially different from the declared description.
- Content