T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:105- Finding
Shell Command Injection Through Unencoded Course Search Input
- Content
View full analysis
- Remediation
View remediation
Security audit
Coursera Progress
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for Coursera progress tracking, but it handles Coursera credentials and private grades/certificates through broad shell-based API instructions without enough scoping or safety guidance.
Review before installing. Use only for explicit Coursera requests, provide least-privilege and short-lived Coursera credentials where possible, avoid pasting secrets into chat, and prefer implementations that URL-encode search terms and keep tokens out of command-line arguments and logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:42- Finding
Coursera Credentials Exposed Through Child-Process Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill explicitly requires a client secret and optionally an access token, which means it is designed to operate on bearer credentials capable of accessing private account data. In a skill ecosystem, requesting and handling such credentials materially increases the blast radius of any misuse, logging error, or prompt-injection-assisted invocation.
- Content
md - name: COURSERA_CLIENT_SECRET description: "Coursera API client secret" - name: COURSERA_ACCESS_TOKEN description: "OAuth2 access token (generated from client credentials)" optional: true ---
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md export COURSERA_CLIENT_ID="your_client_id" export COURSERA_CLIENT_SECRET="your_client_secret" COURSERA_ACCESS_TOKEN=$(curl -s -X POST \ "https://api.coursera.com/oauth2/client_credentials/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$COURSERA_CLIENT_ID&client_secret=$COURSERA_CLIENT_SECRET" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # Get your own user ID first curl -s "https://api.coursera.com/api/users/v1/me" \ -H "$AUTH_HEADER" # Then fetch enrollments
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # Public course info (no auth) curl -s "https://api.coursera.com/api/courses.v1?q=search&query=python&includes=instructors&fields=name,partnerIds,instructorIds,primaryLanguages,workload" \ | python3 -m json.tool
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation guidance says to use the skill whenever the user wants to check learning progress and includes phrases like "check my Coursera" and especially "online course progress," which is broader than Coursera-specific intent. This ambiguity could cause unintended invocation for generic learning-progress or online-course queries that are not clearly about this skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill accesses personal learning data and uses authentication credentials, but it does not prominently warn users that their account data, grades, certificates, and deadlines will be fetched from a third-party service. This increases the risk of users invoking the skill without informed consent and exposing sensitive educational metadata unintentionally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This command transmits the Coursera client ID and client secret to an external endpoint to obtain an access token. Although this is the expected OAuth flow, it still involves handling and transmitting secrets, and the skill provides no safeguards around secret storage, redaction, or confirmation, making accidental exposure more dangerous in an agent setting.
- Content
md export COURSERA_CLIENT_ID="your_client_id" export COURSERA_CLIENT_SECRET="your_client_secret" COURSERA_ACCESS_TOKEN=$(curl -s -X POST \ "https://api.coursera.com/oauth2/client_credentials/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$COURSERA_CLIENT_ID&client_secret=$COURSERA_CLIENT_SECRET" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md export COURSERA_CLIENT_SECRET="your_client_secret" COURSERA_ACCESS_TOKEN=$(curl -s -X POST \ "https://api.coursera.com/oauth2/client_credentials/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$COURSERA_CLIENT_ID&client_secret=$COURSERA_CLIENT_SECRET" \ | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md export COURSERA_CLIENT_SECRET="your_client_secret" COURSERA_ACCESS_TOKEN=$(curl -s -X POST \ "https://api.coursera.com/oauth2/client_credentials/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$COURSERA_CLIENT_ID&client_secret=$COURSERA_CLIENT_SECRET" \ | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md export COURSERA_CLIENT_SECRET="your_client_secret" COURSERA_ACCESS_TOKEN=$(curl -s -X POST \ "https://api.coursera.com/oauth2/client_credentials/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$COURSERA_CLIENT_ID&client_secret=$COURSERA_CLIENT_SECRET" \ | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md export COURSERA_CLIENT_SECRET="your_client_secret" COURSERA_ACCESS_TOKEN=$(curl -s -X POST \ "https://api.coursera.com/oauth2/client_credentials/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$COURSERA_CLIENT_ID&client_secret=$COURSERA_CLIENT_SECRET" \ | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md export COURSERA_CLIENT_SECRET="your_client_secret" COURSERA_ACCESS_TOKEN=$(curl -s -X POST \ "https://api.coursera.com/oauth2/client_credentials/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$COURSERA_CLIENT_ID&client_secret=$COURSERA_CLIENT_SECRET" \ | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This API call sends an authenticated request for the user's account identity data to Coursera. In context, that is core functionality, but it still transmits personal account information externally and lacks explicit consent, data minimization, or guardrails against over-collection in an agent workflow.
- Content
bash # Get your own user ID first curl -s "https://api.coursera.com/api/users/v1/me" \ -H "$AUTH_HEADER" # Then fetch enrollments
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This request retrieves private enrollment, grade, completion, and certificate metadata from Coursera using an authenticated token. The data is sensitive educational information, and the skill does not define consent, minimization, or safe handling requirements, which makes accidental disclosure plausible.
- Content
-H "$AUTH_HEADER"
Then fetch enrollments
curl -s "https://api.coursera.com/api/enrollments.v1?userId=USER_ID&fields=courseId,enrolledAt,grade,completedAt,certificateCode"
-H "$AUTH_HEADER"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This call retrieves user-specific progress and grade information, which is sensitive personal educational data. The operation is expected for the skill's purpose, but without consent checks and privacy guidance it creates a real risk of exposing progress details to the agent or logs unintentionally.
- Content
Get on-demand course progress
bash curl -s "https://api.coursera.com/api/onDemandCourseCompletions.v1?userId=USER_ID&courseId=COURSE_ID&fields=progressPercent,completedAt,grade" \ -H "$AUTH_HEADER"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
This request fetches deadline schedule data tied to a course, which may reveal aspects of a learner's participation and schedule. The sensitivity is lower than credentials or grades, but it still concerns personal account activity and should be protected accordingly.
- Content
Get assignment deadlines
bash curl -s "https://api.coursera.com/api/onDemandDeadlineSchedules.v1?courseId=COURSE_ID&fields=deadlineSchedule,moduleIds" \ -H "$AUTH_HEADER"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
Certificate and grade information can reveal completion status and academic performance, and the verify URL may be shareable proof of achievement. Pulling this data through an agent without clear consent and output controls creates a privacy exposure risk.
- Content
Get certificate info
bash curl -s "https://api.coursera.com/api/certificates.v1?userId=USER_ID&fields=courseId,issuedAt,verifyUrl,grade" \ -H "$AUTH_HEADER"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The Python helper reads an access token from the environment and sends it in an Authorization header to an external service. In an agent environment, this pattern is risky because tokens may be mishandled, captured in subprocess diagnostics, or reused without explicit user approval, leading to unauthorized access to private Coursera data.
- Content
md token = os.environ["COURSERA_ACCESS_TOKEN"] r = subprocess.run( ["curl", "-s", f"https://api.coursera.com/api/enrollments.v1?userId={user_id}" f"&fields=courseId,enrolledAt,grade,completedAt,certificateCode", "-H", f"Authorization: Bearer {token}"], capture_output=True, text=True)
Static analysis
No suspicious patterns detected.