T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:33- Finding
Weather API Request Transmits Location and API Credentials over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
W Skill Pack
Security checks for vulnerabilities and agentic risk
Overview
This skill is broad and has privacy/security rough edges, but its behavior is mostly disclosed, purpose-aligned, and not deceptive.
Before installing, be aware that this skill sends lookup/search inputs to third-party services and should be changed to use HTTPS for weather, environment-based API keys, encoded request parameters, timeouts, and a pinned requests version. Avoid entering sensitive locations, search terms, or health data unless you are comfortable with the in-memory tracking and external API behavior.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependency Produces Non-Reproducible Installations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises a very broad set of common intents, increasing the chance it will be invoked in situations beyond a user's explicit expectations. Over-broad activation can cause unnecessary access to user prompts and data, especially because the skill spans web search, health-related tracking, and reminders in a single package.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documents storage of weight logs, workout plans, and water reminders but provides no privacy notice, retention policy, or explanation of how sensitive health-related data is handled. Even if storage is only in-memory, users are not informed about collection scope, lifecycle, or whether data may persist across sessions in the hosting environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
This code sends user-provided location data and an API key to an external service over HTTP. Because the channel is unencrypted, network observers can intercept or modify the request and response, exposing sensitive query data and credentials and enabling tampering.
- Content
python try: # Using OpenWeatherMap API (you'll need to add your API key) api_key = "YOUR_OPENWEATHER_API_KEY" url = f"http://api.openweathermap.org/data/2.5/weather?q={location}&appid={api_key}&units=metric" response = requests.get(url) data = response.json()
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
This function transmits user input to an external dictionary provider, which is a genuine data egress/privacy issue in environments where outbound sharing is restricted or must be disclosed. The use of HTTPS lowers transport risk, so the main concern is external data sharing rather than interception.
- Content
python try: # Using Dictionary API (you'll need to add your API key) api_key = "YOUR_DICTIONARY_API_KEY" url = f"https://api.dictionaryapi.dev/api/v2/entries/en/{word}" response = requests.get(url) data = response.json()
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The dictionary endpoint explicitly uses the English path segment '/en/', and the Wikipedia API targets 'en.wikipedia.org'. This forces English-language behavior without user opt-in or explanation, which violates the language/locale policy for skills that should not impose a specific language by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill name and feature descriptions include mixed-language labels such as 'weather查询', 'Word学习', and 'Wiki搜索', which impose a bilingual presentation without stating that users can choose their preferred language. This can violate language or locale expectations when no opt-in or justification is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The weather function transmits a user-supplied location to a third-party service without any notice, consent, or privacy disclosure. Location data can be sensitive, and the risk is increased here because the request uses plain HTTP rather than HTTPS, exposing the query and API key to interception in transit.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The dictionary lookup sends the user's query to an external API without telling the user. While a single word is usually low sensitivity, queries may still contain private, proprietary, or accidental sensitive input, so silent transmission creates a privacy issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The Wikipedia search function sends arbitrary user queries to Wikipedia without notice. Search queries can reveal sensitive interests or internal information, so undisclosed external transmission is a real but low-severity privacy weakness.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The web search function transmits user queries to Google Custom Search without warning or consent. Web search terms can contain highly sensitive data, and sending them to a third party without disclosure creates a clear privacy and compliance concern.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency is specified without a version pin, which makes builds non-reproducible and can cause the skill to install an unexpectedly vulnerable or breaking release over time. In a security-sensitive agent environment, this increases supply-chain risk because the actual installed package version is unknown and may drift to a compromised or insecure release.
- Content
text requests
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The manifest references requests without a pinned version even though multiple known advisories exist for that package, so it is impossible to determine whether installation will select an affected release. This is dangerous because vulnerable versions of a common HTTP library can expose credentials, weaken TLS/request handling, or leak sensitive information depending on which release is resolved.
- Content
Static analysis
No suspicious patterns detected.