T09 · Insecure Skill Coding Practices
Error
- Location
scripts/location_service.py:45- Finding
Server-Side Request Forgery Through Incomplete Host Validation and Unrestricted Redirects
- Content
View full analysis
- Remediation
View remediation
Security audit
Location Service
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its location-service purpose, but it needs review because its automatic link resolver can make unsafe outbound requests and its dispatcher runs helper scripts from a fixed external path.
Review before installing in any environment with access to internal services or sensitive network metadata. Avoid submitting home, workplace, or current-location details unless you are comfortable sending them to external geocoding providers, and prefer a version that validates exact URL hostnames, restricts redirects, and runs bundled helper scripts by relative path.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/location_service.py:105- Finding
Execution of Python Scripts From an External Hard-Coded Workspace Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises behavior that depends on network access and executable scripts, but it does not declare any tool scope or permissions boundaries. This weakens reviewability and can cause the skill to run with broader capabilities than users or the platform expect, increasing the risk of unintended network access or shell execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states that it sends addresses, coordinates, and weather queries to external services such as Nominatim and weather integrations, but it does not present an explicit privacy warning to users. Location data is often sensitive, and silent transmission to third parties can expose home, work, or travel information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Google Maps short-link feature implicitly performs an HTTP request to resolve third-party URLs, but the skill does not warn users before doing so. A pasted link may therefore trigger outbound requests and disclose metadata or user intent to external services without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This documentation describes sending addresses and coordinates to the public Nominatim service but does not warn users that potentially sensitive location data is transmitted to an external third party. In a location-service skill, that omission matters because geocoding inputs can reveal home, work, travel, or other private user information, creating privacy and compliance risk even if the API usage itself is legitimate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sends user-supplied address data to the external Nominatim geocoding service, which can expose potentially sensitive location information to a third party without any notice, consent flow, or privacy control. In a location-service skill, this behavior is functionally expected, but it still creates a real privacy risk because users may submit home, work, or other sensitive addresses assuming local processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script sends precise user-supplied latitude and longitude to the external Nominatim service, which can expose sensitive location data to a third party without any disclosure, consent flow, or privacy notice. Exact coordinates may reveal a user's home, workplace, or current whereabouts, so the issue is a real privacy/security concern even though the network call is functionally required for reverse geocoding.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run_script(script_path, args): """Run a Python script and return its output""" try: result = subprocess.run( [sys.executable, script_path] + args, capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Resolving a maps.app.goo.gl URL causes an outbound network request to Google using user-supplied input, which can disclose that the user is processing a specific location link and may expose metadata such as IP address and access timing. In an agent skill context, this is more sensitive because users may not realize that simply parsing a URL triggers external contact.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill geocodes addresses and reverse-geocodes coordinates via helper scripts without any explicit notice that precise location data may be transmitted to external geocoding services. Location information is sensitive personal data, and in this skill’s context that makes undisclosed data egress more dangerous than in a generic text-processing tool.
- Content