T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_day.py:11- Finding
Caller-Controlled API Endpoint Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Isdayoff Checker
Security checks for vulnerabilities and agentic risk
Overview
The skill has a clear workday-checking purpose, but its script allows caller-chosen API endpoints, which can make unexpected network requests from the user's machine.
Install only if you are comfortable with a helper script that makes outbound HTTP(S) requests. Use the default isdayoff.ru endpoint, avoid passing untrusted values to --endpoint, and consider removing or allowlisting that option before use in automated agent workflows.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill explicitly relies on outbound network access to a third-party API but does not declare any tool scope or permission boundary in its metadata. In an agent environment, undeclared network capability weakens least-privilege controls, making it easier for the skill to perform unexpected external requests or be repurposed for data exfiltration if the script or endpoint handling changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description and operational guidance are entirely in Russian, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user choice.
- Content