T09 · Insecure Skill Coding Practices
Error
- Location
scripts/relay.mjs:188- Finding
Configurable Remote Endpoint Allows Plaintext Transmission of API Credentials and Conversation History
- Content
View full analysis
- Remediation
View remediation
Security audit
Relay To Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed relay to external AI endpoints, with real privacy considerations but no hidden or purpose-mismatched behavior found.
Install only if you are comfortable sending prompts and retained session history to the configured AI endpoint. Use trusted HTTPS endpoints, avoid entering secrets or regulated data, keep RELAY_API_KEY scoped to this use, and delete or reset local sessions when history should not be retained.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/relay.mjs:156- Finding
Conversation Transcripts Are Persisted Without Explicit Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This skill's core purpose is to relay arbitrary messages to external AI agents, which creates a direct exfiltration channel for user-provided data and locally stored session history. The surrounding context increases risk because it supports arbitrary OpenAI-compatible endpoints, multi-turn memory, and plaintext local transcript storage, making accidental or abusive disclosure more likely if secrets or sensitive content are sent.
- Content
md # Relay To Agent Send messages to AI agents on any OpenAI-compatible endpoint. Works with Connect Chat, OpenRouter, LiteLLM, vLLM, Ollama, and any service implementing the Chat Completions API. ## List available agents
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Flag | Description | Default | |------|-------------|---------| | `--agent ID` | Target agent identifier | (required) | | `--reset` | Reset conversation before sending | off | | `--list` | List available agents | — | | `--session ID` | Custom session identifier | `default` | | `--json` | Raw JSON output | off |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill clearly uses environment-derived secrets and networked relay behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and can cause operators to invoke a skill with broader capabilities than intended, especially since it can transmit user prompts and stored history to arbitrary configured endpoints.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill is explicitly designed to send user messages and prior session history to a configurable external OpenAI-compatible endpoint. In context this is intended functionality, but it is still a real data exfiltration boundary because RELAY_BASE_URL/baseUrl can point to third-party or attacker-controlled services and the relayed content may include sensitive information.
- Content
json { "baseUrl": "https://api.example.com/v1", "agents": [ { "id": "my-agent",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json { "baseUrl": "https://api.example.com/v1", "agents": [ { "id": "my-agent",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js { "baseUrl": "https://api.example.com/v1", "agents": [ { "id": "my-agent",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This skill is explicitly configured to relay user messages to an external service at api.connectchat.ai, which creates a real data-transmission boundary. Any prompts, conversation content, or potentially sensitive data sent through the skill may leave the local trust boundary and be processed by a third party, making privacy, compliance, and data-handling risks dependent on that external provider.
- Content
json { "baseUrl": "https://api.connectchat.ai/api", "agents": [ { "id": "connect-flow-ai",
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description for Post2Prompt says it converts content into 'detailed English prompts,' which imposes a specific language choice in natural-language behavior. Under the policy, forcing a language without user opt-in or a documented region-specific justification is a violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script persists full conversation history, including user and assistant messages, to a session file under the user's home directory without any explicit notice, consent, or retention controls. This can expose sensitive prompts, secrets, or regulated data to other local users, backups, endpoint tooling, or later unintended access, especially because users may assume a transient relay rather than durable logging.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The tool sends the accumulated conversation history to a remote API endpoint without an explicit user-facing warning at send time or in the primary UX path. Because the endpoint is configurable via agents.json or RELAY_BASE_URL, users may unknowingly transmit sensitive data to third-party or self-hosted services with different trust boundaries and data handling practices.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with a caret range (^3.4.2), which permits automatic installation of newer minor and patch releases that have not been reviewed for this skill. That increases supply-chain risk because a compromised upstream release or breaking security regression could be pulled in without an explicit code change in this repository.
- Content
json "license": "ISC", "type": "commonjs", "dependencies": { "openai-fetch": "^3.4.2" } }
Static analysis
No suspicious patterns detected.