Forms

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:23 PM UTC
• Version: 1.0.0

Overview

This is a forms-building documentation skill with expected examples for local storage, integrations, and self-hosting, but users should handle form data and credentials carefully.

Install is reasonable for form-building help, but do not copy the integration and self-hosting snippets directly into production. Pin Docker images and npm package versions, keep API tokens server-side and out of URLs, avoid sending full submission contents to chat/email unless needed, and define consent, retention, deletion, encryption, and access controls before collecting real submissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: selfhosted.md:20

Finding

Mutable Docker Image Tags Permit Unreviewed Runtime Changes

Content

View full analysis

Remediation

View remediation

``` - If a human-readable version is retained, pin both the version and digest and treat the digest as authoritative. - Verify image signatures and provenance before deployment, such as with Sigstore/Cosign where the publisher supports it. - Scan pinned images for known vulnerabilities and secrets before promotion. - Use a controlled update process that reviews release notes, regenerates the digest, scans the new image, tests it, and requires approval before production rollout. - Run containers as non-root with a read-only root filesystem and minimal Linux capabilities. - Do not mount the Docker socket or unnecessary host directories. - Restrict outbound network access and provide only narrowly scoped credentials required by each service. ]]>

T08 · Insecure Dependencies

Warning

• Location: selfhosted.md:53

Finding

Unpinned npm Packages May Resolve to Unreviewed Dependency Versions

Content

View full analysis

Remediation

View remediation

survey-react-ui@ ``` - Generate and commit `package-lock.json`, then use `npm ci` in CI and production builds. - Review lockfile changes and verify package provenance and integrity before accepting updates. - Use automated dependency scanning and a controlled update process. - Where application compatibility permits, use `npm ci --ignore-scripts` or explicitly allow only required lifecycle scripts. - Run dependency installation in an isolated, non-privileged build environment without unnecessary secrets. - Configure the expected npm registry explicitly and use scoped registry settings to reduce dependency-confusion exposure. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: integrations.md:71

Finding

CRM API Credential Is Embedded in a URL Query String

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly recommends storing form submissions locally in ~/forms/submissions but provides no guidance on access controls, encryption, retention, or the possibility that submissions may contain sensitive personal data. In a forms skill, collected responses commonly include names, emails, phone numbers, files, and other regulated data, so normalizing local storage without safeguards can lead to accidental exposure or mishandling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document provides numerous examples that send form-submission data, including emails, names, messages, and webhook payloads, to third-party services without any privacy notice, consent guidance, or data-minimization warning. In a forms skill, this is materially risky because operators may copy these patterns directly and transmit personal data to external processors without informing users or establishing an appropriate legal basis.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · integrations.md (reported line 41)May include surrounding context.

Mailchimp

bash

# Add to list
curl -X POST "https://usX.api.mailchimp.com/3.0/lists/{list_id}/members" \
  -H "Authorization: Bearer ${MAILCHIMP_API_KEY}" \
  -d '{"email_address":"[e-mail]","status":"subscribed"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The ConvertKit example sends the API secret as form data rather than using a safer authorization header or server-side credential handling pattern, increasing the chance of accidental exposure in logs, proxies, debugging tools, or shell history. It also demonstrates transmitting user email to a third party without any nearby privacy warning, which is particularly relevant in a forms integration context.

Content

Scanner excerpt · integrations.md (reported line 49)May include surrounding context.

ConvertKit

bash

# Add subscriber + tag
curl -X POST "https://api.convertkit.com/v3/tags/{tag_id}/subscribe" \
  -d "api_secret=${CONVERTKIT_SECRET}&email=[e-mail]"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · integrations.md (reported line 55)May include surrounding context.

Brevo (Sendinblue)

bash

curl -X POST "https://api.brevo.com/v3/contacts" \
  -H "api-key: ${BREVO_API_KEY}" \
  -d '{"email":"[e-mail]","listIds":[5]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · integrations.md (reported line 65)May include surrounding context.

HubSpot

bash

# Create contact
curl -X POST "https://api.hubapi.com/crm/v3/objects/contacts" \
  -H "Authorization: Bearer ${HUBSPOT_TOKEN}" \
  -d '{"properties":{"email":"[e-mail]","firstname":"John"}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The Pipedrive example places the API token in the query string, which is a recognized insecure pattern because URLs are commonly captured in logs, browser history, proxy records, analytics, and monitoring systems. In a forms integration workflow, this can expose credentials that permit unauthorized access to CRM data or API actions.

Content

Scanner excerpt · integrations.md (reported line 73)May include surrounding context.

Pipedrive

bash

# Create person
curl -X POST "https://api.pipedrive.com/v1/persons?api_token=${PIPEDRIVE_TOKEN}" \
  -d '{"name":"John Doe","email":"[e-mail]"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · integrations.md (reported line 94)May include surrounding context.

Airtable

bash

curl -X POST "https://api.airtable.com/v0/${BASE_ID}/${TABLE}" \
  -H "Authorization: Bearer ${AIRTABLE_TOKEN}" \
  -d '{"fields":{"Email":"[e-mail]","Name":"John"}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · integrations.md (reported line 101)May include surrounding context.

Notion

bash

curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer ${NOTION_TOKEN}" \
  -H "Notion-Version: 2022-06-28" \
  -d '{"parent":{"database_id":"xxx"},"properties":{...}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The Telegram example embeds the bot token directly in the URL path, which can leak via logs, monitoring tools, shell history, or accidental copy/paste, and it sends personal data in message text to a third-party messaging service. In a forms context, combining credential exposure risk with ad hoc notification of PII makes this more dangerous than a generic external-call example.

Content

Scanner excerpt · integrations.md (reported line 131)May include surrounding context.

Telegram

bash

curl "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
  -d "chat_id=${CHAT_ID}&text=New form: [e-mail]"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The sample API route collects and stores personal data (email, name, message) and sends a notification email, but it does not present any contextual warning in the example about sensitive-data handling, data minimization, retention, or avoiding submission of regulated data. In a forms skill, this omission is more dangerous because readers are likely to reuse the snippet for real customer or internal data collection, increasing the risk of privacy violations, overcollection, and unsafe handling of sensitive submissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file demonstrates collecting personal data such as email and name and indicates submission to an API, but it does not mention any warning or disclosure about sending that data off-device. Under the markdown-file criteria, examples that affect user data or privacy should include some warning about the behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The schema explicitly specifies sending contact-form contents to an API endpoint, which involves transmitting user data. The surrounding markdown does not include any warning or disclosure about privacy, retention, or secure handling of submitted information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown example performs a network request containing the user's email address, which is personally identifiable information. The file does not warn readers that asynchronous validation may disclose entered addresses to a server before final submission.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.