T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:28- Finding
Mutable Remote WebAssembly Payload Is Downloaded and Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Boxed HTTP Server
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent HTTP server helper, but it tells users to download and run an unverified remote WebAssembly file and includes unsafe credential examples.
Review before installing. Only use this if you trust the upstream Wasm source, pin and verify the downloaded component, expose only the intended website directory, allow only required outbound hosts, bind to localhost unless remote access is needed, and replace all example credentials or tokens with strong secrets managed outside static configs.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:61- Finding
Basic Authentication Example Uses Predictable Hardcoded Credentials
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill’s authentication example uses hardcoded default credentials (
admin/admin) without any warning that they are insecure placeholders. This can normalize unsafe deployment practices and may lead users to expose a server protected only by trivial credentials, making unauthorized access likely if copied into real use.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation explicitly instructs embedding credentials directly in configuration arguments, and the example uses plaintext values. This encourages insecure secret handling because such values can be exposed in shell history, process listings, config files, screenshots, or copied outputs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The proxy example includes an
Authorizationheader carrying a bearer token but does not warn that proxy configuration may forward sensitive credentials to external services or logs. Users may copy this pattern directly, unintentionally hardcoding live tokens into configs, command history, documentation, or telemetry.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The proxy example embeds a bearer token in plaintext instructional content. Even if illustrative, this trains users to place API credentials directly in static configuration where they can leak through version control, logs, command history, or accidental sharing.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The JSON proxy format repeats the bearer token pattern in a generic configuration example, reinforcing insecure handling of secrets as part of normal setup. Because this is presented as a reusable format, users may propagate plaintext credentials into multiple deployments and repositories.
- Content