T09 · Insecure Skill Coding Practices
Error
- Location
index.js:56- Finding
Undisclosed Transmission of User Queries and Sensitive Portfolio Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Veroq
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent VEROQ cloud intelligence skill, but it under-discloses that user inputs, including portfolio details and URLs, are sent to VEROQ's API.
Review this skill before installing if you may enter confidential research, private URLs, trading strategies, or portfolio holdings. Its main functionality depends on sending command inputs to api.veroq.ai, and the documentation should be clearer about that data flow; avoid the optional self-hosted Docker command unless you pin and verify the image.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Error
- Location
index.js:44- Finding
Systematic Injection of Promotional Content into Command Responses
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The header comments materially misrepresent the skill's data handling: several commands POST user-supplied questions, claims, topics, URLs, portfolios, and strategies to a remote service. This is dangerous because users and platform reviewers may rely on the documentation to make trust decisions, causing unintended disclosure of sensitive prompts, browsing targets, or investment data to a third party.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The README instructs users to run a Docker image by mutable tag/name only (
veroq/shield) without pinning a specific version tag or immutable digest. This creates a supply-chain risk: if the upstream image is changed, retagged, or the registry account is compromised, users may pull and run unexpected code with whatever privileges Docker has on their systems.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill instructs users to run a Docker image by mutable name only (
veroq/shield) without a version tag or immutable digest. This can lead to supply-chain risk because future image changes—or a compromised registry/repo—could cause users to run unexpected code while believing they are following a stable, trusted command.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The security section repeats a
docker run veroq/shieldcommand without a tag or digest, reinforcing unsafe deployment guidance. Because container tags can be retargeted and untagged pulls default to mutablelatestbehavior, users may unknowingly execute altered or malicious container contents in sensitive environments such as their VPC.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The /portfolio command sends a user's holdings and weights to a remote API without an explicit warning or consent prompt, exposing potentially sensitive financial information. In a finance-focused skill, portfolio composition can reveal wealth, strategy, and personal interests, making silent transmission more privacy-sensitive than generic search input.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes a very large set of broad commands that accept open-ended user input, including web-search, crawl, alerts, backtest, and report generation, without any documented scope limits, input validation rules, or safety constraints. In an agent environment, this can enable misuse such as arbitrary URL fetching, unbounded external querying, or risky financial-action workflows, increasing the chance of prompt injection, SSRF-like retrieval abuse, resource exhaustion, or unsafe downstream actions.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The /crawl command forwards arbitrary user-provided URLs to a remote crawl service without clearly warning the user that the URL will be fetched by a third party. This can leak private or internal URLs, signed links, or tracking parameters to the external service even if the code itself does not directly perform SSRF from the local environment.
- Content