Security audit

Iserv

Security checks for vulnerabilities and agentic risk

Overview

This IServ skill is useful but needs Review because it handles live school-platform credentials, remote messaging and file mutation, and has verified unsafe URL and filename handling that can expose credentials or overwrite local files.

Install only if you trust the IServ instance and are comfortable giving the skill account-level access to mail, messenger, files, and exercises. Use an HTTPS ISERV_BASE_URL, avoid running destructive commands unless you personally verify the target, and treat downloads or exercise submissions as risky until same-origin checks and safe filename handling are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/iserv.py:266
Finding: Credentials may be transmitted over plaintext HTTP or to a redirected origin
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/iserv.py:1225
Finding: Server-controlled exercise form actions can exfiltrate selected local files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/iserv.py:603
Finding: Server-controlled download filenames permit writes outside the requested directory
Content: View full analysis
Path: out_dir_p = Path(out_dir) out_dir_p.mkdir(parents=True, exist_ok=True) # filename from Content-Disposition; fallback to provided name fname = None cd = r.headers.get("Content-Disposition") or "" m = re.search(r"filename\*=UTF-8''([^;]+)", cd) if m: fname = _html.unescape(m.group(1)) if not fname: m = re.search(r"filename=\"?([^\";]+)\"?", cd) if m: fname = _html.unescape(m.group(1)) if not fname: fname = fallback_name or "download.bin" out_path = out_dir_p / fname with open(out_path, "wb") as f: for chunk in r.iter_content(chunk_size=1024 * 128): if chunk: f.write(chunk) return out_path ``` A separate exercise attachment downloader repeats the same unsafe construction: ```python # filename from Content-Disposition fname = None cd = r.headers.get("Content-Disposition") or "" m = re.search(r"filename\*=UTF-8''([^;]+)", cd) if m: fname = _html.unescape(m.group(1)) if not fname: m = re.search(r"filename=\"?([^\";]+)\"?", cd) if m: fname = _html.unescape(m.group(1)) if not fname: fname = "attachment.bin" out_path = out_dir_p / fname with open(out_path, "wb") as f: for chunk in r.iter_content(chunk_size=1024 * 128): if chunk: f.write(chunk) return out_path ``` ### Technical Analysis Both download implementations trust the `filename` or `filename*` value from the remote `Content-Disposition` header. The value is joined directly to the requested output directory without removing path separators, ...[truncated 1947 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata and module docstring frame this as a data-access client, but the implementation includes active capabilities to send mail and messenger messages, upload/rename/delete files, create folders, and submit exercises. In an agent setting, this scope expansion is dangerous because a caller expecting read-only behavior could unintentionally trigger remote state changes or data exfiltration through the same credentialed session.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The top-level docstring states the goal is read access, but the code implements multiple write-side operations such as mail_send, mail_reply, messenger_send, files_upload, files_mkdir, files_rename, files_delete, and exercise_submit. This mismatch can mislead integrators, policy engines, or users into granting credentials to a tool that can alter remote data and communicate outward.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Claiming a read-access goal while embedding extensive write functionality creates a deceptive trust boundary for downstream agents and users. In practice, this can bypass least-privilege assumptions and allow an agent to send messages, upload files, or delete data when the operator believed the tool was informational only.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: The skill includes outbound communication primitives via messenger_send and mail_send/mail_reply, which can transmit arbitrary text to external recipients using the user's authenticated account. In a data-rich school-platform client, these commands materially increase exfiltration risk because an agent can read mail/messages/files and then relay sensitive content outward.
Content: Scanner excerpt · scripts/iserv.py (reported line 1097)May include surrounding context.
python
except Exception as e: last = e continue raise RuntimeError(f"Could not send message to chat_id={chat_id}. Last error: {last}") # ---------------------- # Exercises (Aufgaben)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill performs sensitive operations using both environment variables and outbound network access, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this increases the chance of overbroad execution, making it easier for the skill to access secrets and send them to arbitrary IServ endpoints or attacker-controlled URLs if misconfigured.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The files_rename implementation can move or rename remote content with no confirmation or validation of overwrite/conflict conditions. An agent error could disrupt coursework or stored files by relocating or replacing expected paths under the authenticated user's account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The files_delete path performs destructive remote deletion immediately, trying multiple endpoints and HTTP methods, without any confirmation, dry-run, or safety interlock. In an agent workflow, a prompt misunderstanding or adversarial instruction could cause irreversible loss of user files on the IServ instance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: exercise_submit uploads a local file and posts a submission form directly to the remote service without any user-facing warning, confirmation, or content review. In an agent environment, this can leak unintended local files or prematurely submit incorrect work under the user's identity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill instructs users to provide credentials through environment variables but does not warn about common exposure paths such as shell history, process inspection, CI logs, crash dumps, or accidental debug output. Because this skill handles live login credentials for a school platform, missing handling guidance can lead to credential leakage and account compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example --comment "Abgabe" hardcodes a German-language message in the skill documentation. This can be a locale/language policy issue because it presents one language as the default without opt-in or indicating that users may choose their preferred language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.