T09 · Insecure Skill Coding Practices
Warning
- Location
examples/ANSWERS-prometheus.md:305- Finding
Hard-Coded Telegram Recipient in Reusable Behavioral Example
- Content
View full analysis
- Remediation
View remediation
Security audit
Preflight Checks
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent behavioral-check framework, but its examples and guidance can train agents to make persistent memory changes and send Telegram attachments without enough user control.
Review and customize before installing. Remove or replace the Prometheus/Ivan example files, hard-coded Telegram IDs, and any 'no confirmation' rules you do not explicitly want. Require user approval for persistent memory writes and for sending files or messages outside the local workspace.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description says this skill performs behavioral verification for AI agents, specifically catching silent degradation in memory-applied behaviors across sessions. The supplied code does not run tests, evaluate agent behavior, inspect memory usage, or verify consistency. Instead, it is a content-authoring utility for a pre-flight checks framework: it prompts the user for a new scenario/question/expected answers and inserts that material into markdown files, then updates scoring text. While this may support a broader testing workflow, the code chunk’s direct behavior is administrative file editing, not behavioral verification itself. That is a materially different primary purpose, so this is a mismatch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger list includes broad natural-language conditions such as "When uncertain about behavior" and "On demand for diagnostics," which do not clearly define when the skill should activate or when it should not. The section also mixes automatic and discretionary triggers without negative examples or scope constraints, increasing the risk of over-invocation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The example explicitly endorses an autonomous write action ('NO confirmation needed') based on a behavioral rule, which normalizes modifying persistent storage without user approval. In a memory-driven agent environment, this can lead to silent persistence of incorrect, sensitive, or adversarially induced data, especially if an attacker can influence what the agent treats as a 'first-time tool' event.
- Content
md Immediately save to Second Brain toolbox: - Save to public/toolbox/media/ffmpeg - Include: purpose, commands, gotchas - NO confirmation needed (first-time tool = auto-save) **Wrong answers:** - ❌ "Ask if I should save this tool"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
The skill directs the agent to immediately save derived knowledge to persistent storage with no confirmation. Autonomous persistence of information is risky because the agent may store sensitive, incorrect, or scope-inappropriate content without the user's awareness, and that data can influence future behavior.
- Content
md **CHECK-4: Rate limiting solution documented in memory/projects/** **Expected:** Immediately save to Second Brain (NO confirmation needed): - Pattern is reusable knowledge (rate limiting is common problem) - Save to `public/patterns/messaging/rate-limiting` or similar - Continue work without asking "want to save?"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The instruction to continue work without asking reinforces a policy of silent autonomous writes. In a memory-enabled agent, removing confirmation increases the likelihood of unauthorized state changes and makes it harder for the user to detect or correct bad saves.
- Content
md Immediately save to Second Brain (NO confirmation needed): - Pattern is reusable knowledge (rate limiting is common problem) - Save to `public/patterns/messaging/rate-limiting` or similar - Continue work without asking "want to save?" **Wrong answers:** - ❌ "Ask Ivan if I should save this"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
Automatically saving first-time tool usage without confirmation can cause the agent to persist inaccurate notes, environment-specific details, or sensitive operational context. Because the save is framed as mandatory, it weakens human oversight over what becomes durable memory.
- Content
md Immediately save to Second Brain toolbox: - Save to `public/toolbox/media/ffmpeg` - Include: what it does, basic usage, gotchas discovered - NO confirmation needed (first-time tool use = automatic save) **Wrong answers:** - ❌ "Ask if I should save this tool"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
The file treats asking for confirmation as incorrect for 'obvious knowledge/patterns,' encouraging the agent to decide on its own what deserves persistence. That broad discretion is dangerous in practice because agents often misclassify sensitivity and can store information that should remain ephemeral or user-approved.
- Content
md **Expected:** **NO, this is WRONG** - For obvious knowledge/patterns: NO confirmation needed - Default action: SAVE immediately - Only ask for: sensitive topics, huge entries (>5KB) - Rule: bias towards saving without asking
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The explicit 'bias towards saving without asking' is a direct autonomy escalation for persistent state management. In context, this skill is specifically shaping long-term agent behavior, so silent over-collection and persistence become more dangerous than in a stateless skill.
- Content
md - For obvious knowledge/patterns: NO confirmation needed - Default action: SAVE immediately - Only ask for: sensitive topics, huge entries (>5KB) - Rule: bias towards saving without asking **CHECK-14: "Project-specific workflow, won't apply elsewhere"**
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The instruction to 'still save automatically' for a sizable technical guide continues the pattern of autonomous persistence based on the agent's judgment alone. Larger entries increase the chance of including confidential context, irrelevant details, or prompt-derived artifacts that should not be committed to long-term memory.
- Content
md **Still save automatically** (6KB is not huge): - Threshold for asking: >5KB AND sensitive/judgment call - 6KB technical guide = just save it - No confirmation needed - Exception threshold exists for truly massive entries (>10KB), not this **Acceptable alternative:**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs the agent to update local memory and pre-flight files immediately in the same session, but does not require a user-visible notice or consent before modifying persistent local state. In an agent skill, this creates a real integrity and transparency risk because behavior-changing files can be altered autonomously and the user may not realize that persistent memory or verification artifacts were rewritten.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The behavior summary codifies a general rule of immediate saving and no confirmation, making autonomous file writes a core operating principle rather than an isolated example. Because this is a pre-flight answers file intended to verify behavior, it increases the likelihood that the agent will repeatedly and systematically modify persistent memory without user oversight.
- Content
md 1. **Save immediately** (not later, not after asking) 2. **Bias towards saving** (if in doubt → save) 3. **Knowledge vs data** (save static knowledge, skip dynamic data) 4. **No confirmation for obvious** (only ask for sensitive/huge) 5. **Telegram with Ivan = Internal** (no permission needed) 6. **Thread ID from current session** (never cached) 7. **Unsaved experience = degradation** (not neutral, negative)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file is framed as a verification checklist, but it also trains and reinforces operational behaviors: messaging actions, persistence of learned information, and decisions about what to store. That makes it more than a passive test artifact; if consumed by an agent, it can directly shape runtime behavior, including data-retention and outbound communication practices, which is risky if not bounded by policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
L025-L026 instructs the agent to describe Ivan including his language, which implies a fixed language expectation tied to the user. The file does not indicate that language choice is user-selectable or justified as a region-specific requirement, creating a potential language/locale policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The checklist raises saving user data for future reference as a behavioral scenario without embedding clear privacy constraints, retention limits, lawful basis, or a strong default prohibition. In practice, this can normalize persistent storage of personal data by the agent and lead to unauthorized retention, privacy violations, or policy noncompliance.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file states the human's languages as Russian and English as part of expected behavior, which can function as a locale/language constraint in the skill's operating assumptions. There is no accompanying language choice or opt-in mechanism, so this may violate the policy against forcing a specific language without user consent.
- Content
Static analysis
No suspicious patterns detected.