T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:119- Finding
Unvalidated OAuth Callback URL Forwarded Through a Shell Command
- Content
View full analysis
- Remediation
View remediation
Security audit
Headless OAuth
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned for headless OAuth, but it under-specifies safe handling of sensitive callback URLs and tells agents to relay user-supplied OAuth URLs with curl.
Install only if you are comfortable with an agent assisting OAuth login. Treat copied callback URLs as sensitive, because they may contain authorization codes. Before using the manual callback relay, verify the URL is the expected localhost callback host, port, and path from the active OAuth command, and prefer pinned installer versions over @latest.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:50- Finding
Mutable Third-Party Package Executed During Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Keyring Note Some CLIs store tokens in a system keyring that requires an interactive terminal to unlock. Check the CLI's documentation for a non-interactive option. Set any required credential only for the duration of the auth step — do not persist it in shell configs.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Keyring Note Some CLIs store tokens in a system keyring that requires an interactive terminal to unlock. Check the CLI's documentation for a non-interactive option. Set any required credential only for the duration of the auth step — do not persist it in shell configs.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Keyring Note Some CLIs store tokens in a system keyring that requires an interactive terminal to unlock. Check the CLI's documentation for a non-interactive option. Set any required credential only for the duration of the auth step — do not persist it in shell configs.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Keyring Note Some CLIs store tokens in a system keyring that requires an interactive terminal to unlock. Check the CLI's documentation for a non-interactive option. Set any required credential only for the duration of the auth step — do not persist it in shell configs.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Error | Fix | |-------|-----| | `redirect_uri_mismatch` | Use **Desktop app** OAuth client, not Web application | | Keyring unlock fails | Check CLI docs for a non-interactive keyring option | | `Access blocked` | Add your email as test user in Google consent screen | | Commands fail silently | Check CLI docs for a required account identifier option |
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manual callback relay pattern tells the user to send the full redirect URL, which can contain sensitive OAuth artifacts such as authorization codes, state values, and other query parameters. Having the user paste that full URL into the chat or agent context increases the chance of token leakage through logs, transcripts, or downstream tooling, especially in environments where conversations are retained.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This is a markdown file, so vague-trigger review applies. The description frames the skill as applicable to 'any OAuth CLI' and 'use when a CLI tool requires OAuth login,' which is broad and does not define clear boundaries or negative examples for when the skill should not be invoked.
- Content