T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run-mission-control-visual-qa.sh:14- Finding
Remote Command Injection Through Unquoted Environment-Controlled Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
Billy — Mission Control Visual QA
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but its SSH helper has unsafe environment-controlled shell command construction that could let commands run on the remote host if those variables are influenced.
Review before installing. Use only with a trusted SSH target and trusted environment variables, avoid overriding the remote paths unless you control them, and treat generated screenshots as sensitive internal data. The shell helper should be fixed to validate or safely quote remote paths before normal use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/mission-control-visual-qa.js`: Puppeteer-based remote runner (intended to run on SAPCONET).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/run-mission-control-visual-qa.sh`: Local helper that copies and runs the Node script over `scp` + `ssh`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/run-mission-control-visual-qa.sh`: Local helper that copies and runs the Node script over `scp` + `ssh`.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries even though it is designed to use environment-controlled behavior and invoke SSH/SCP-based execution on a remote host. Without declared restrictions, an agent may run the skill with broader-than-intended access, allowing abuse of environment variables such as SSH_TARGET, REMOTE_RUN_DIR, or OUTPUT_DIR to redirect execution or data handling to unintended systems or locations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script saves full-page screenshots of arbitrary provided URLs to a local output directory, which can capture sensitive information visible in the browser such as internal dashboards, user data, tokens rendered in-page, or other confidential content. In this skill context, the behavior is intentional for visual QA, but the lack of warning, minimization, or retention controls makes unintended sensitive-data-at-rest exposure a real risk, especially on shared hosts or persistent workspaces.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script creates directories on a remote host over SSH and copies a local JavaScript file via SCP, but it provides no confirmation prompt, logging beyond the usage line, or inline comment/docstring warning the user that remote system state will be modified. Because this is a code file, these safety-relevant remote write and execution actions should have some visible disclosure unless clearly communicated elsewhere in the skill description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line 24 runs a command on a remote machine using SSH, which is a safety-critical subprocess/shell operation. The script does not display a warning, request confirmation, or include inline documentation explaining that user-supplied URLs will be sent to and processed on a remote host.
- Content
Static analysis
No suspicious patterns detected.