T09 · Insecure Skill Coding Practices
Warning
- Location
memory-template.md:68- Finding
Persistent Memory Policy Permits Plaintext Secret Storage
- Content
View full analysis
- Remediation
View remediation
Security audit
Trending Now
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent trend-monitoring helper that uses disclosed public web sources and local notes, with a small plaintext-secret storage wording issue users should avoid.
Install only if you want an agent to monitor public trend sources using your topic keywords and keep local monitoring state in ~/trending-now. Before enabling heartbeat mode, set clear topics, sources, active hours, timezone, and language scope. Do not allow the skill to store credentials or secrets in its Markdown memory files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md Without scope, trend monitoring becomes noisy and low trust. ### 2. Use HEARTBEAT.md as the Operating Contract Always maintain topic and output rules in `HEARTBEAT.md`. Every cycle must follow one contract: - actionable update -> send structured message - no meaningful change -> return `HEARTBEAT_OK`
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template asks users to record 'when this skill should auto-activate' and 'when this skill should stay silent' but provides no specific trigger phrases, scope constraints, or negative examples. This can lead to overly broad or inconsistent activation criteria that may overlap with ordinary conversation and cause unintended invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language field 'language_scope: english | multilingual' presents English-only operation as a built-in option without any instruction to obtain user preference or justify the restriction. This risks a language/locale policy violation because it can bias the skill toward a specific language by default.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash mkdir -p ~/trending-now touch ~/trending-now/{memory.md,topics.md,runs.md,alerts.md} chmod 700 ~/trending-now chmod 600 ~/trending-now/{memory.md,topics.md,runs.md,alerts.md}
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
mkdir -p ~/trending-now touch ~/trending-now/{memory.md,topics.md,runs.md,alerts.md} chmod 700 ~/trending-now chmod 600 ~/trending-now/{memory.md,topics.md,runs.md,alerts.md}
text 5. If `memory.md` is empty, initialize it from `memory-template.md`.
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The markdown sets
Timezone | Europe/Madridas a default operating locale, which is a natural-language locale constraint. The file does not indicate that this locale is optional, user-configurable, or justified as region-specific, so it may violate language/locale policy expectations.- Content