T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:29- Finding
Unnecessary Disclosure of Local Artifact and Repository Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Mpps Attestation
Security checks for vulnerabilities and agentic risk
Overview
This skill openly creates external attestation receipts; the main thing to watch is that its examples can send artifact paths and repository metadata to mpps.io.
Before installing or using this skill, treat mpps.io as an external receipt service. Use opaque labels such as "artifact" instead of local file paths, omit repository and commit context unless you intentionally want that recorded, and do not submit secrets, customer data, private source text, raw prompts, or hashes of short secrets without salting.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash ARTIFACT_HASH=$(sha256sum "$ARTIFACT_PATH" | awk '{print "sha256:" $1}') curl -s -X POST https://api.mpps.io/v1/receipts \ -H "Content-Type: application/json" \ -d "{ \"action\": \"agent.task.complete\",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The referenced api.mpps.io endpoint is a third-party external destination embedded directly in the skill. In agent environments, hardcoded external service destinations increase the risk of unreviewed data egress and make the skill more dangerous because the whole purpose is to send workflow-derived metadata out of the local trust boundary.
- Content
bash ARTIFACT_HASH=$(sha256sum "$ARTIFACT_PATH" | awk '{print "sha256:" $1}') curl -s -X POST https://api.mpps.io/v1/receipts \ -H "Content-Type: application/json" \ -d "{ \"action\": \"agent.task.complete\",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The referenced api.mpps.io endpoint is a third-party external destination embedded directly in the skill. In agent environments, hardcoded external service destinations increase the risk of unreviewed data egress and make the skill more dangerous because the whole purpose is to send workflow-derived metadata out of the local trust boundary.
- Content
bash ARTIFACT_HASH=$(sha256sum "$ARTIFACT_PATH" | awk '{print "sha256:" $1}') curl -s -X POST https://api.mpps.io/v1/receipts \ -H "Content-Type: application/json" \ -d "{ \"action\": \"agent.task.complete\",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This endpoint reference supports a workflow that sends notarization data off-host. The skill context makes this more dangerous because it is designed specifically for external anchoring, so accidental use in sensitive environments could disclose artifact relationships or business process timing.
- Content
bash HASH=$(echo -n "$DATA" | sha256sum | awk '{print "sha256:" $1}') curl -s -X POST https://api.mpps.io/v1/notarize \ -H "Content-Type: application/json" \ -d "{\"content_hash\": \"$HASH\"}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This endpoint reference supports a workflow that sends notarization data off-host. The skill context makes this more dangerous because it is designed specifically for external anchoring, so accidental use in sensitive environments could disclose artifact relationships or business process timing.
- Content
bash HASH=$(echo -n "$DATA" | sha256sum | awk '{print "sha256:" $1}') curl -s -X POST https://api.mpps.io/v1/notarize \ -H "Content-Type: application/json" \ -d "{\"content_hash\": \"$HASH\"}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This Python example sends receipt data to api.mpps.io over the network. Even if only hashes are sent, hashes of low-entropy data and contextual metadata may leak information or enable correlation of private artifacts across environments, so the external transmission is security-relevant.
- Content
md artifact = b"agent output bytes" h = "sha256:" + hashlib.sha256(artifact).hexdigest() receipt = requests.post( "https://api.mpps.io/v1/receipts", json={ "action": "agent.task.complete",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This Python example sends receipt data to api.mpps.io over the network. Even if only hashes are sent, hashes of low-entropy data and contextual metadata may leak information or enable correlation of private artifacts across environments, so the external transmission is security-relevant.
- Content
md artifact = b"agent output bytes" h = "sha256:" + hashlib.sha256(artifact).hexdigest() receipt = requests.post( "https://api.mpps.io/v1/receipts", json={ "action": "agent.task.complete",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The Python code hardcodes an HTTPS POST target at api.mpps.io for receipt submission. This is a real security concern in a skill because it normalizes outbound transfer of work-derived metadata to a non-local service, which may violate least-privilege or organizational data handling policies.
- Content
md h = "sha256:" + hashlib.sha256(artifact).hexdigest() receipt = requests.post( "https://api.mpps.io/v1/receipts", json={ "action": "agent.task.complete", "subject": "output.json",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Verify
bash curl https://api.mpps.io/v1/verify/mpps_att_0c27bebca6dc4bd6For structured receipts, recompute the manifest hash if you need stronger evidence: