Incident.io

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:45 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent incident.io integration, but it gives an agent live authority to create, edit, close, and publicly update incidents without clear confirmation or safety guidance.

Install only if you trust the workspace and intend the agent to operate on real incident.io data. Use a least-privilege API key, prefer test or retrospective mode when practicing, and require human review before creating, closing, editing, or posting incident updates because these actions can notify responders or expose information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use this auth pattern:

```bash
curl -s "https://api.incident.io/v2/..." \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill includes ready-to-run examples that create and modify live incidents but does not clearly warn users that these are write operations against a production API. This increases the risk of accidental incident creation, escalation, or closure when a user copies commands without realizing they will change real organizational state.

External Transmission

Medium

• Category: Data Exfiltration

Content

Required fields: `idempotency_key`, `visibility`. A `severity_id` is needed to open an active incident.

```bash
curl -s -X POST "https://api.incident.io/v2/incidents" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: This finding points to the same create-incident example, which is a mutating authenticated call to an external API. In this context, the risk is accidental state change in a production incident-management system if run without clear warnings.

External Transmission

Medium

• Category: Data Exfiltration

Content

Required fields: `idempotency_key`, `visibility`. A `severity_id` is needed to open an active incident.

```bash
curl -s -X POST "https://api.incident.io/v2/incidents" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: This finding points to the same create-incident example, which is a mutating authenticated call to an external API. In this context, the risk is accidental state change in a production incident-management system if run without clear warnings.

External Transmission

Medium

• Category: Data Exfiltration

Content

Only provided fields are updated; omitted fields remain unchanged.

```bash
curl -s -X POST "https://api.incident.io/v2/incidents/INCIDENT_ID/actions/edit" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: This is the same edit-incident example and involves a live authenticated write to an external service. It is risky because it can alter incident metadata and trigger notifications if executed against production data unintentionally.

External Transmission

Medium

• Category: Data Exfiltration

Content

Only provided fields are updated; omitted fields remain unchanged.

```bash
curl -s -X POST "https://api.incident.io/v2/incidents/INCIDENT_ID/actions/edit" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: This is the same edit-incident example and involves a live authenticated write to an external service. It is risky because it can alter incident metadata and trigger notifications if executed against production data unintentionally.

External Transmission

Medium

• Category: Data Exfiltration

Content

Then update the incident:

```bash
curl -s -X POST "https://api.incident.io/v2/incidents/INCIDENT_ID/actions/edit" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 94% confidence
• Finding: This is the close-incident edit call and performs a live external state change. Running it against the wrong incident or status could disrupt incident handling and produce inaccurate records.

External Transmission

Medium

• Category: Data Exfiltration

Content

Then update the incident:

```bash
curl -s -X POST "https://api.incident.io/v2/incidents/INCIDENT_ID/actions/edit" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 94% confidence
• Finding: This is the close-incident edit call and performs a live external state change. Running it against the wrong incident or status could disrupt incident handling and produce inaccurate records.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Post an Incident Update

```bash
curl -s -X POST "https://api.incident.io/v2/incident_updates" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This is the same post-update example and represents a live authenticated write to the external incident service. The primary risk is accidental publication of sensitive or incorrect status information to incident stakeholders.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Post an Incident Update

```bash
curl -s -X POST "https://api.incident.io/v2/incident_updates" \
  -H "Authorization: Bearer $INCIDENTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This is the same post-update example and represents a live authenticated write to the external incident service. The primary risk is accidental publication of sensitive or incorrect status information to incident stakeholders.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill tells users to export an API key and use it in shell commands but does not include guidance on protecting the credential from shell history, logs, screenshots, or accidental echoing. While the examples do not directly print the secret, missing handling guidance can still lead to credential exposure in operational use.