T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:20- Finding
API Credentials Exposed Through Chat, Command-Line Arguments, and URL Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Fapi Reddit
Security checks for vulnerabilities and agentic risk
Overview
This skill is a narrow Reddit API helper, but it tells users to expose paid-service credentials in chat and URL parameters, which needs review before installation.
Review before installing. Use only a narrowly scoped, revocable fapi.uk API key, do not paste API keys or auth tokens into chat, and understand that requests spend account credits. Prefer secure configuration storage and rotate any credential already shared through chat or logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly tells users they can paste their API key and auth token directly into chat, which encourages disclosure of secrets in an unsafe channel. Chat transcripts may be logged, retained, exposed to plugins, or later referenced by the model, creating a direct credential leakage risk and possible account misuse.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This instruction actively solicits sensitive credentials in chat, including an API key and auth token, which is a strong secret-disclosure anti-pattern. Because the skill is for a paid external service and tokens may grant account access or billable usage, exposing them in conversation materially increases the risk of theft, replay, and unauthorized spending.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill claims it can be used through broad natural-language requests and will autonomously read the file, choose endpoints, assemble parameters, and send requests, but it does not define clear activation boundaries, disallowed operations, or confirmation requirements. In a paid API context, this increases the chance of unintended external requests, unnecessary credit consumption, and accidental processing of sensitive user input.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file states that results will be summarized in 'natural Chinese,' and later says the agent 'must strictly comply' with the calling rules, making the language requirement mandatory. This is a natural-language policy issue because it forces a specific language without user opt-in or a documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This rule instructs the agent to summarize results in fluent Chinese unless the user asks for raw data, but it does not offer any language preference mechanism. Forcing a single language in user-facing behavior violates the stated policy unless users can choose or the locale restriction is clearly justified.
- Content