T09 · Insecure Skill Coding Practices
Error
- Location
skill.js:22- Finding
Unrestricted API endpoint receives user content and bearer credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
01 Tomato Ip Parse
Security checks for vulnerabilities and agentic risk
Overview
This skill performs its core novel-analysis task, but it sends full user text and an API key to a configurable external endpoint and falsely reports every compliance check as safe.
Review this skill carefully before installing. Only use it with non-sensitive novel text or with a trusted HTTPS API endpoint that you control, and do not rely on its compliance_check result because the inspected code always marks content as safe.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
skill.js:37- Finding
Compliance check always reports submitted content as safe
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill description is written only in Chinese and presents the skill as Chinese-language specific without any opt-in, alternative locale, or statement that users may choose another language. Per the policy, forcing a specific language or locale without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is entirely in Chinese and describes the skill's behavior only in that language, which indicates a language-specific constraint without offering the user a language choice or documenting that the skill is intentionally region-specific. Under the policy, language or locale restrictions should be opt-in or clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The embedded prompt is entirely in Chinese and instructs the model using Chinese-only output labels, effectively imposing a specific language/locale behavior. There is no opt-in, fallback, or documented justification that this skill is intentionally limited to Chinese-language operation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill transmits the full
novel_textand title to an external chat completion API, which can expose proprietary, copyrighted, personal, or otherwise sensitive user content to a third party. In this skill, the transmission is functionally necessary for the feature, but there is no minimization, consent flow, or disclosure, so the data exposure risk is real rather than theoretical.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code sends full novel content to an external service without any user-facing warning, disclosure, or indication in the return value that third-party transmission occurred. This creates a transparency and privacy problem because users may reasonably assume their text is processed locally or within a trusted boundary when it is actually exported off-platform.
- Content