T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/migrate_timestamps.py:21- Finding
Predictable Temporary File Enables Symlink-Based File Overwrite During Timestamp Migration
- Content
View full analysis
- Remediation
View remediation
Security audit
Token Usage Tracker
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its token-tracking purpose, but review is warranted because its log-maintenance scripts can unsafely rewrite files in some local deployments.
Install only after reviewing the scripts and setting the log directory to a private, trusted workspace path. Do not run the migration or dedupe utilities as root or from a directory writable by other users unless the temporary-file handling is hardened. Treat the systemd file as a template and change the user and paths before enabling it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dedupe_log.py:11- Finding
Predictable Temporary File Enables Symlink-Based File Overwrite During Log Deduplication
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises file-reading and file-writing functionality through its described scripts and log handling, but it does not declare any tool scope such as permissions or allowed-tools. This creates a trust and review gap: consumers cannot easily determine the intended file-system access boundaries, increasing the risk of overbroad access, unsafe deployment, or misuse if the examples are wired into an agent pipeline without restrictions.
- Content