T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:217- Finding
Command Injection Through Untrusted Shell Command Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Traktor Web Scraper
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it advertises, but it gives agents broad web-scraping, background-task, local-write, and shell-download instructions without enough safety controls.
Install only if you are comfortable with an agent browsing supplied sites, spawning background extraction tasks, downloading remote assets, and writing files into your project. Prefer using it in a restricted workspace and network environment, and avoid running it on untrusted or attacker-controlled sites until URL validation, filename sanitization, allowlists, and explicit confirmation controls are added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:93- Finding
Unrestricted URL Navigation and Asset Retrieval Enables SSRF
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs broad scraping, parallel extraction, and local persistence of large amounts of remote content without an upfront warning about resource usage, storage impact, legal/compliance considerations, or the fact that it will create files and perform many network requests. In context, this can lead users to trigger high-impact actions unintentionally and increases the chance of unsafe or unauthorized data collection.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs execution of shell commands that incorporate values derived from user-supplied URLs and dynamically discovered asset URLs, including mkdir and curl. Without strict validation, normalization, and safe argument construction, this creates command-injection and unsafe filesystem-write risks, especially when prompts or implementations interpolate hostile values into shell commands.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest description presents the skill primarily as a website asset/content extractor. The implementation goes beyond pure extraction by performing extensive local filesystem modification: creating directory trees, writing JSON manifests, and downloading copies of remote assets to disk. While related to scraping, this behavior is broader than a simple extraction/read-only interpretation of the description.
- Content