T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fatsecret-cli.sh:67- Finding
<![CDATA[Arbitrary Python Code Execution Through CLI Argument Interpolation]]>
- Content
View full analysis
- Remediation
View remediation
Security audit
Fatsecret
Security checks for vulnerabilities and agentic risk
Overview
The skill fits a FatSecret nutrition and diary workflow, but it needs Review because crafted CLI input can execute Python and the skill stores and exposes long-lived account credentials unsafely.
Install only if you are comfortable giving the skill FatSecret account access and storing long-lived tokens locally. Before use, fix the CLI interpolation bug, stop printing or returning token secrets, restrict credential-file permissions, pin dependencies, and treat diary logging as an account-write capability that should require explicit user confirmation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fatsecret_agent_helper.py:56- Finding
<![CDATA[Long-Lived OAuth Credentials Stored Without Enforced Restrictive Permissions]]>
- Content
View full analysis
bool: """Save credentials provided by user.""" try: os.makedirs(CONFIG_DIR, exist_ok=True) config = { "consumer_key": consumer_key, "consumer_secret": consumer_secret, "saved_at": time.time(), "saved_at_human": time.ctime() } with open(CONFIG_FILE, 'w') as f: json.dump(config, f, indent=2) ``` Token storage in the same helper: ```python def _save_tokens(self, access_token: str, access_token_secret: str) -> bool: """Save access tokens.""" try: os.makedirs(CONFIG_DIR, exist_ok=True) token_data = { "access_token": access_token, "access_token_secret": access_token_secret, "consumer_key": self.consumer_key, "consumer_secret": self.consumer_secret, "created": time.time(), "created_human": time.ctime() } with open(TOKENS_FILE, 'w') as f: json.dump(token_data, f, indent=2) ``` The standalone authentication script has equivalent storage: ```python token_data = { "access_token": access_token, "access_token_secret": access_token_secret, "consumer_key": consumer_key, "consumer_secret": consumer_secret, "created": time.time(), "created_human": time.ctime() } os.makedirs(CONFIG_DIR, exist_ok=True) with open(TOKENS_FILE, 'w') as f: json.dump(token_data, f, indent=2) ``` ### Technical Analysis The project stores the consumer secret and ...[truncated 1905 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fatsecret_auth.py:157- Finding
<![CDATA[OAuth Token Secrets Disclosed Through Standard Output and Agent Return Values]]>
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
<![CDATA[Unpinned, Redundant, and Incomplete Dependency Declaration]]>
- Content
View full analysis
=0.2.0 requests>=2.31.0 requests[socks]>=2.31.0 ``` Additionally, `scripts/fatsecret_client.py` directly imports a package that is not explicitly declared: ```python from requests_oauthlib import OAuth1Session ``` ### Technical Analysis All declared packages use open-ended lower bounds. A future installation may therefore resolve to package versions that were not present or reviewed when this Skill was audited. This makes installations non-reproducible and expands exposure to later compromised or incompatible releases. `requests` is listed twice, once directly and once with the `socks` extra. The `pyfatsecret` package was not imported by any reviewed source file, so it unnecessarily increases the supply-chain attack surface. Meanwhile, `requests_oauthlib` is imported directly but is not explicitly included in the dependency manifest. Its availability may depend on an undeclared transitive dependency or the environment, producing inconsistent behavior. No evidence of typosquatting, an unsafe custom package index, a remote installation script, or an intentionally malicious package was found. The confirmed issue is unsafe dependency-management practice rather than proof that the current packages are malicious. ### Attack Path 1. A user creates a new environment and installs `requirements.txt`. 2. The package resolver selects the newest releases satisfying the open-ended constraints. 3. A later compromised, malicious, or unexpectedly changed release is installed without review. 4. Package code executes during installation, import, or normal Skill operation. 5. That package inherits the Skill process's filesystem and network access, including possible access to locally stored FatSecret credentials. Alternatively, the un ...[truncated 714 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims broad nutrition features but the documented implementation focuses on loading OAuth credentials, using proxies, and making authenticated requests. When sensitive behaviors are more prominent than the public description indicates, users may unknowingly authorize a skill with materially greater privacy and account-access implications than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims broad nutrition features but the documented implementation focuses on loading OAuth credentials, using proxies, and making authenticated requests. When sensitive behaviors are more prominent than the public description indicates, users may unknowingly authorize a skill with materially greater privacy and account-access implications than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill claims broad nutrition features but the documented implementation focuses on loading OAuth credentials, using proxies, and making authenticated requests. When sensitive behaviors are more prominent than the public description indicates, users may unknowingly authorize a skill with materially greater privacy and account-access implications than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims broad nutrition features but the documented implementation focuses on loading OAuth credentials, using proxies, and making authenticated requests. When sensitive behaviors are more prominent than the public description indicates, users may unknowingly authorize a skill with materially greater privacy and account-access implications than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims broad nutrition features but the documented implementation focuses on loading OAuth credentials, using proxies, and making authenticated requests. When sensitive behaviors are more prominent than the public description indicates, users may unknowingly authorize a skill with materially greater privacy and account-access implications than expected.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill explicitly stores consumer secrets and OAuth access tokens on local disk, including long-lived OAuth1 tokens. Local token persistence is dangerous because any other process, compromised agent, shared container, backup system, or misconfigured volume with read access to that directory can steal credentials and gain ongoing access to the user's FatSecret account and diary data.
- Content
md | File | Contents | Created By | |------|----------|------------| | `$CONFIG_DIR/config.json` | Consumer Key/Secret | User (manual) | | `$CONFIG_DIR/oauth1_access_tokens.json` | OAuth1 access tokens | `auth` command | | `$CONFIG_DIR/token.json` | OAuth2 token (auto-refreshed) | OAuth2 client | Where `$CONFIG_DIR` is `~/.config/fatsecret` by default, or the value of `FATSECRET_CONFIG_DIR` if set.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Simple OAuth1 3-legged authentication script for FatSecret. Guides the user step-by-step to obtain access tokens. """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Simple OAuth1 3-legged authentication script for FatSecret. Guides the user step-by-step to obtain access tokens. """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Simple OAuth1 3-legged authentication script for FatSecret. Guides the user step-by-step to obtain access tokens. """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Simple OAuth1 3-legged authentication script for FatSecret. Guides the user step-by-step to obtain access tokens. """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Simple OAuth1 3-legged authentication script for FatSecret. Guides the user step-by-step to obtain access tokens. """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return auth_url def step3_get_access_token(consumer_key, consumer_secret, oauth_token, oauth_token_secret): """Step 3: Get access token with PIN.""" print("\n" + "="*60) print("STEP 3: Getting Access Token") print("="*60)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return auth_url def step3_get_access_token(consumer_key, consumer_secret, oauth_token, oauth_token_secret): """Step 3: Get access token with PIN.""" print("\n" + "="*60) print("STEP 3: Getting Access Token") print("="*60)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return auth_url def step3_get_access_token(consumer_key, consumer_secret, oauth_token, oauth_token_secret): """Step 3: Get access token with PIN.""" print("\n" + "="*60) print("STEP 3: Getting Access Token") print("="*60)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return auth_url def step3_get_access_token(consumer_key, consumer_secret, oauth_token, oauth_token_secret): """Step 3: Get access token with PIN.""" print("\n" + "="*60) print("STEP 3: Getting Access Token") print("="*60)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def step3_get_access_token(consumer_key, consumer_secret, oauth_token, oauth_token_secret): """Step 3: Get access token with PIN.""" print("\n" + "="*60) print("STEP 3: Getting Access Token") print("="*60) # Ask user for PIN
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python access_token_secret = response_params.get("oauth_token_secret") if not access_token or not access_token_secret: print("❌ Access tokens not received!") return None, None print(f"✅ Access Token: {access_token}")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python access_token_secret = response_params.get("oauth_token_secret") if not access_token or not access_token_secret: print("❌ Access tokens not received!") return None, None print(f"✅ Access Token: {access_token}")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The script prints the OAuth access token to stdout, which can expose credentials through terminal scrollback, shell history capture tools, CI logs, remote session logging, or shared support transcripts. In the context of an authentication utility, displaying live bearer-equivalent secrets materially increases the chance of credential compromise.
- Content
python print("❌ Access tokens not received!") return None, None print(f"✅ Access Token: {access_token}") print(f"✅ Access Token Secret: {access_token_secret}") return access_token, access_token_secret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The script prints the access token secret to stdout, exposing a credential component required for OAuth1 request signing. Leakage of this secret, especially alongside the token and consumer credentials stored elsewhere in the script, can allow unauthorized API access on behalf of the user.
- Content
python return None, None print(f"✅ Access Token: {access_token}") print(f"✅ Access Token Secret: {access_token_secret}") return access_token, access_token_secret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Pause to let user authorize input("\nPress ENTER when you have authorized the app and have the PIN...") # Step 3: Access token access_token, access_token_secret = step3_get_access_token( consumer_key, consumer_secret, oauth_token, oauth_token_secret )
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The implementation materially differs from the declared skill purpose: it routes nutrition lookups to Open Food Facts instead of the FatSecret integration promised by the manifest. In an agent setting, this is dangerous because it can bypass expected provider constraints, data provenance, authentication, and user trust boundaries, causing the agent to call an unintended third-party service and return mismatched or lower-assurance data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Get credentials from https://platform.fatsecret.com
bash mkdir -p ~/.config/fatsecret cat > ~/.config/fatsecret/config.json << EOF { "consumer_key": "YOUR_KEY",
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documentation describes capabilities that require environment access, local file writes, shell execution, and outbound network access, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope declarations can cause the skill to be invoked with broader privileges than reviewers or users expect, increasing the chance of credential handling, persistence, and network behavior occurring without adequate guardrails.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The authentication section says the skill supports OAuth2 for read-only access and OAuth1 for full access, but the changelog later states OAuth2 was removed and OAuth1 is now used for all operations. Security-sensitive documentation contradictions can cause agents or operators to choose a weaker review path, assume lower privilege, or mis-handle tokens and consent flows.
- Content
Static analysis
No suspicious patterns detected.