T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:31- Finding
Hardcoded Shared-Secret Notification Endpoint Used over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Ntfy Cli
Security checks for vulnerabilities and agentic risk
Overview
This notification skill is mostly purpose-aligned, but it exposes a real-looking shared-secret ntfy topic and shows sending email metadata over plaintext HTTP.
Before installing, replace the example endpoint with your own HTTPS ntfy URL, rotate the shown topic if it was real, use ntfy authentication or access controls, and avoid sending email bodies, credentials, tokens, or sensitive metadata in notifications.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # On Debian/Ubuntu sudo apt install ntfy # Or download binary from https://ntfy.sh/
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example at these lines includes email metadata/content and sends it to an ntfy endpoint, which is a data transmission to another service or host. Even if self-hosted, this can expose sensitive information through network transit, server logs, notification storage, or recipient devices, and the skill does not sufficiently warn agents to minimize sensitive content or verify the trust boundary of the target endpoint.
- Content