T08 · Insecure Dependencies
Warning
- Location
SKILL.md:16- Finding
Unpinned Third-Party npm Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
Sardis Policy
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its Sardis wallet-policy purpose, but it can make durable spending-policy changes with a Sardis API key and includes risky shell examples that deserve review before installation.
Install only if you trust the Sardis integration and can use a least-privileged SARDIS_API_KEY. Review every policy before creation or replacement, avoid permissive templates unless intended, and prefer pinned dependencies plus safer jq-built JSON request bodies before copying the shell examples into automation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:246- Finding
Unsafe Shell Expansion in JSON Request Construction
- Content
View full analysis
/dev/null; then echo "Payment would be approved" echo "Remaining daily: $(echo $CHECK_RESULT | jq -r '.remaining_daily')" else echo "Payment would be BLOCKED" echo "Reason: $(echo $CHECK_RESULT | jq -r '.reason')" fi ``` The same construction pattern is used in the batch example: ```bash echo "$TRANSACTIONS" | jq -c '.[]' | while read tx; do AMOUNT=$(echo $tx | jq -r '.amount') VENDOR=$(echo $tx | jq -r '.vendor') RESULT=$(curl -s -X POST https://api.sardis.sh/v2/policies/check \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "wallet_id": "'$WALLET_ID'", "amount": "'$AMOUNT'", "vendor": "'$VENDOR'" }') ALLOWED=$(echo $RESULT | jq -r '.allowed') echo "$AMOUNT to $VENDOR: $ALLOWED" done ``` ### Technical Analysis The examples terminate a single-quoted JSON string, expand shell variables outside quotes, and then reopen the quoted string: ```bash "vendor": "'$VENDOR'" ``` Because `$WALLET_ID`, `$AMOUNT`, and `$VENDOR` are unquoted during expansion, the shell applies word splitting and pathname expansion to their values. A value containing spaces, wildcard characters, quotes, or strings resembling curl arguments can therefore change the argument boundaries passed to curl. Independently, JSON met ...[truncated 2819 chars]- Remediation
View remediation
/dev/null; then printf 'Remaining daily: %s\n' \ "$(printf '%s\n' "$CHECK_RESULT" | jq -r '.remaining.daily // .remaining_daily')" fi ``` - Use `IFS= read -r tx` in loops to prevent backslash interpretation and preserve complete input records. - Reject malformed or unexpected JSON response schemas rather than treating parsing failures as normal policy denials. - Use `--fail-with-body`, explicit timeouts, and an allowlisted fixed URL. - Run curl in a restricted environment with outbound network access limited to the intended Sardis API host. - Avoid placing authorization headers on any invocation that may accept dynamically generated URL operands. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (20)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md env: - SARDIS_API_KEY bins: - curl - jq primaryEnv: SARDIS_API_KEY emoji: "🛡️"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API Endpoint Patterns Base URL: `https://api.sardis.sh/v2` ### Create Policy with Natural Language
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
- Higher per-transaction ($500)
- API vendor allowlist
- 24/7 allowed (services don't sleep)
- Auto-approve under $100
text ### Template: Restricted Trial
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md AMOUNT=$(echo $tx | jq -r '.amount') VENDOR=$(echo $tx | jq -r '.vendor') RESULT=$(curl -s -X POST https://api.sardis.sh/v2/policies/check \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md WALLET_ID=wallet_abc123 # Create new policy NEW_POLICY=$(curl -s -X POST https://api.sardis.sh/v2/policies \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Template | Use Case | Key Features | |----------|----------|--------------| | `conservative-procurement` | Purchasing agent | Low limits, vendor allowlist, approval required | | `api-service-agent` | API/SaaS agent | Higher limits, 24/7, auto-approve | | `restricted-trial` | Trial/demo | Very low limits, expires | | `employee-card` | Employee spending | Moderate limits, category blocks | | `unrestricted` | Trusted agent | High limits, minimal restrictions |