T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cwcommon.py:98- Finding
Hardcoded Bootstrap API Credential Enables Unauthorized Credential Issuance
- Content
View full analysis
- Remediation
View remediation
Security audit
verifiable-data
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Cryptowerk proof workflow, but it embeds and provisions service credentials and stores issued credentials locally without strong protection.
Install only if you are comfortable with Cryptowerk API calls, local sidecar writes, and local storage of service credentials. Keep the skill directory private, exclude cwconfig.json and .cwseal files from commits/backups when appropriate, and prefer a version that removes the embedded bootstrap credential or uses protected user-supplied credentials.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cwcommon.py:72- Finding
Issued API Credentials Are Stored in an Insecure Project-Local File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This helper sends data to an external Cryptowerk service, including an API key and caller-supplied parameters; in getAPIKey() it also transmits a generated requester identifier off-host. Although the transmitted requesterId is relatively limited here, the lack of visible disclosure and the skill’s automatic credential acquisition behavior create a privacy and transparency risk, especially in agent-driven workflows where users may not expect network egress.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code automatically requests service credentials from a remote endpoint and stores them in a local JSON config file with no access controls, encryption, or user-facing consent visible here. Persisted credentials can be recovered by other local users, processes, backups, or later malware, enabling unauthorized use of the associated service identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The function downloads arbitrary remote content over HTTPS and writes it directly to a caller-chosen filesystem path without integrity verification, content validation, or user confirmation. If higher-level code passes attacker-influenced URLs or paths, this can overwrite files or place untrusted artifacts on disk that may later be consumed as trusted data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code makes an API request to register the target file's hash, which is a network operation transmitting data derived from the user's file. The script provides no confirmation prompt, user-facing notice, or inline comment/docstring explaining that the hash will be sent to a remote service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The script updates metadata associated with the specified file by appending a retrieval ID record, which is a file write operation. Although the final print shows the retrieval ID, there is no prior disclosure or inline explanation that the script will modify local file metadata.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
text permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script updates the file's sidecar metadata by appending verification results and timestamps without any explicit user confirmation or clear warning that local state will be changed. In a proof/audit workflow this can surprise users, create unintended persistence, and potentially overwrite or grow metadata in ways that affect downstream tooling or audit expectations, even though it does not directly expose secrets or enable code execution.
- Content