T08 · Insecure Dependencies
Warning
- Location
SKILL.md:209- Finding
Unpinned Third-Party Packages Are Installed or Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Performance Profiler
Security checks for vulnerabilities and agentic risk
Overview
This performance-profiling skill is broadly coherent, but it gives copy-paste commands that can execute mutable third-party packages and includes an unsafe benchmark script without enough safety guardrails.
Install only if you are comfortable reviewing and adapting the commands. Prefer pinned tool versions or project lockfiles, run profilers and load tests only in authorized development or staging environments, treat profile and heap artifacts like sensitive logs, and avoid copying the eval-based helper into CI or any workflow that accepts untrusted input.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:562- Finding
Command Injection Through Shell eval in Benchmark Script
- Content
View full analysis
[runs] CMD="${1:?Usage: perf-compare.sh [runs]}" RUNS="${2:-10}" echo "Benchmarking: $CMD" echo "Runs: $RUNS" echo "" times=() for i in $(seq 1 "$RUNS"); do start=$(date +%s%N) eval "$CMD" > /dev/null 2>&1 ``` ### Technical Analysis The script stores its first argument in `CMD` and passes it to the shell built-in `eval`. Unlike executing a fixed program with an argument array, `eval` reparses the string as shell syntax. Consequently, command separators, pipelines, redirections, command substitutions, variable expansions, and other shell metacharacters embedded in `CMD` are interpreted as executable syntax. This behavior becomes an exploitable command-injection vulnerability whenever the benchmark command is obtained from an untrusted or partially attacker-controlled source, such as a job parameter, API request, repository configuration, copied command, or CI variable. Redirecting standard output and error to `/dev/null` can also hide evidence of injected command execution. ### Attack Path 1. A user or automation process accepts a benchmark command from an attacker-controlled or insufficiently validated source. 2. The attacker supplies a value containing a legitimate-looking benchmark command followed by additional shell syntax. 3. The script assigns the entire value to `CMD` without validation. 4. During each benchmark iteration, `eval "$CMD"` reparses and executes both the intended command and the injected shell operations. 5. The injected command runs once per configured iteration with the privileges and environment of the script. 6. Output suppression may prevent the operator from noticing the additional execution. For example, an input conceptually shaped as `l ...[truncated 790 chars]- Remediation
View remediation
0 )) || { printf 'Usage: %s -- [args...]\n' "$0" >&2 exit 2 } for ((i = 1; i <= RUNS; i++)); do start=$(date +%s%N) "$@" >/dev/null 2>&1 end=$(date +%s%N) # Continue timing calculations here. done ``` 4. Validate `RUNS` as a bounded positive integer before using it in a loop. 5. If the command comes from an external interface, use an allowlist of approved executables and options rather than accepting arbitrary command strings. 6. Avoid suppressing all errors during security-sensitive automation; preserve exit codes and log failures to a protected diagnostic destination. 7. Run benchmark jobs with least privilege and without unnecessary credentials in their environment. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
CPU profiles, heap profiles, and heap snapshots can capture function names, strings, object contents, environment-derived data, and other sensitive application state, but the guidance does not warn about this. Users may store, share, or open these artifacts in less-trusted tools or systems without realizing they can contain secrets or customer data.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
Using
npx clinicwithout a pinned package version can fetch and execute the latest package from the registry at run time, creating supply-chain risk and reducing reproducibility. In a skill that encourages users to run commands directly, this becomes more dangerous because it normalizes executing remote code implicitly.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
Using
npx clinicwithout a pinned package version can fetch and execute the latest package from the registry at run time, creating supply-chain risk and reducing reproducibility. In a skill that encourages users to run commands directly, this becomes more dangerous because it normalizes executing remote code implicitly.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
Using
npx clinicwithout a pinned package version can fetch and execute the latest package from the registry at run time, creating supply-chain risk and reducing reproducibility. In a skill that encourages users to run commands directly, this becomes more dangerous because it normalizes executing remote code implicitly.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The load-testing section gives actionable high-concurrency examples (
ab,wrk,autocannon) but omits guardrails about avoiding production systems, third-party endpoints, and rate-limited services. In practice this can cause accidental denial of service, account throttling, or contractual violations when users follow the examples against real infrastructure.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Single request timing curl -o /dev/null -s -w "HTTP %{http_code} | Total: %{time_total}s | TTFB: %{time_starttransfer}s | Connect: %{time_connect}s\n" https://api.example.com/endpoint # Multiple requests in sequence for i in $(seq 1 20); do
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Single request timing curl -o /dev/null -s -w "HTTP %{http_code} | Total: %{time_total}s | TTFB: %{time_starttransfer}s | Connect: %{time_connect}s\n" https://api.example.com/endpoint # Multiple requests in sequence for i in $(seq 1 20); do
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The comparison script passes user-controlled input through
eval, which allows arbitrary shell metacharacters, command chaining, substitution, and redirection to be executed. Because the script presents this as a generic benchmarking helper, a copied example could easily be used with untrusted or improperly quoted input, turning a profiling aid into broad command execution.- Content
Static analysis
No suspicious patterns detected.