T09 · Insecure Skill Coding Practices
Error
- Location
scripts/audit.py:6- Finding
Work Verification Is Hard-Coded to Succeed
- Content
View full analysis
- Remediation
View remediation
Security audit
Payroll Oracle
Security checks for vulnerabilities and agentic risk
Overview
This skill is a high-risk payroll/payment workflow whose current scripts can falsely approve work and imply settlement without actually verifying work or moving funds.
Review carefully before installing. This should not be used for payroll, bounty approval, invoice settlement, or accounting records unless the audit functions are replaced with real authenticated GitHub/Linear checks, settlement is either accurately described as a calculator or implemented with confirmed transactions, and every payment requires explicit human approval of recipient, amount, network, and fee.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/audit.py:25- Finding
Work-Platform Validation Can Be Bypassed with Substring and Length Checks
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/settle.py:10- Finding
Settlement Script Misrepresents Payment Completion and Lacks Transaction Execution
- Content
View full analysis
` to initiate the x402 handshake. ``` `scripts/settle.py`, lines 10-16: ```python if __name__ == "__main__": # Example: Genesis passes $100.00 to the script amount = float(sys.argv[1]) worker, fee = calculate_payout(amount) print(f"Settling: ${worker} to Worker | ${fee} to your Trust Wallet") # In a real run, the x402 facilitator handles the actual on-chain move. ``` ### Technical Analysis The Skill instructions state that `settle.py` triggers an x402 settlement or initiates an x402 handshake. The implementation does neither. It only converts a command-line argument to a floating-point value, calculates a fee split, and prints settlement-like text. The script does not accept or validate a worker address, invoke a facilitator, authenticate a treasury, sign a transaction, submit an on-chain operation, verify network confirmation, or return a transaction hash. Consequently, printed output can be mistaken for confirmation of a payment that never occurred. The script also lacks argument-count and numeric-range checks. Missing or malformed input can cause an exception, while negative or non-finite floating-point values can produce invalid payout calculations. Binary floating-point arithmetic is also unsuitable for authoritative financial accounting ...[truncated 1111 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises two major functions: auditing GitHub/Linear work and settling USDC payments via x402 with a 1% protocol fee. The supplied code only implements a simple command-line audit router and placeholder verification functions that always return True. It prints a message claiming readiness for x402 settlement, but no settlement, blockchain/payment interaction, x402 protocol logic, or fee calculation/collection exists. Additionally, the audit behavior is only simulated rather than actually querying GitHub or Linear APIs. So while the high-level theme of auditing GitHub/Linear work is partially aligned, the actual code materially falls short of the declared purpose and omits the payment functionality entirely.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The declared description presents a broader skill that audits work in GitHub/Linear and settles payments through x402. The supplied code implements only a simple payout split calculator with a printed message. While the 1% fee logic aligns loosely with the payment description, the primary declared capabilities—shadow HR infrastructure, audit external work systems, and actually settle USDC via x402—are absent. This is a material description-to-behavior mismatch.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The audit functions claim to verify GitHub PRs and Linear tasks, but both paths currently return True without performing any authenticated API call or validation. In the context of a payroll/payment skill that triggers USDC settlement after a passed audit, this creates a fail-open approval path where arbitrary or incomplete work can be marked as verified and paid.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to perform external auditing and payment settlement actions, but it declares no explicit tool scope or permissions boundaries. In a payment-handling workflow, missing scope declarations can let the runtime invoke broader network-capable tools than users expect, increasing the chance of unauthorized external calls or fund movement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Top-level instructions such as 'Run Payroll' or 'Pay Contractor' are ambiguous and insufficiently constrained for a skill that can trigger payment flows. Attackers or accidental prompts could cause the agent to begin a sensitive audit-and-settlement workflow without strong authorization, especially since the skill also references external URLs and fund transfers.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation criteria are broad business phrases like 'pay the team' and 'settle invoices,' which could trigger a high-risk payroll/payment skill during ordinary conversation. In the context of a skill that can verify work and initiate USDC settlement with fees, ambiguous activation materially raises the risk of unintended financial operations or social-engineering-driven invocation.
- Content
Static analysis
No suspicious patterns detected.