T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:14- Finding
Radarr API Key Stored Without Enforced Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Radarr
Security checks for vulnerabilities and agentic risk
Overview
This Radarr skill is mostly coherent, but it includes destructive movie/file deletion and persistent collection monitoring that are not clearly scoped in the main description or protected by strong confirmations.
Review this carefully before installing. Use it only with a Radarr API key you are comfortable granting library mutation rights to, protect the credential file with private permissions, and be especially cautious with remove, --delete-files, and add-collection because they can delete media or enable future automatic additions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes shell commands (
bash scripts/radarr.sh ...) but does not declare corresponding permissions or capabilities in a transparent way. Hidden or undeclared execution capability reduces reviewability and can let a seemingly simple media-management skill perform broader local actions than users expect.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented behavior extends beyond the declared purpose by including removal of movies, optional file deletion, configuration enumeration, and collection-monitoring behavior. This mismatch is dangerous because reviewers or users may authorize the skill expecting only search/add functionality, while the skill also supports destructive and more privileged administrative actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description omits the movie-removal capability even though the skill documents commands for removing titles and optionally deleting files. Undisclosed destructive functionality increases the chance of accidental approval or misuse, particularly in an environment where users rely on metadata to understand risk before enabling a skill.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata says it searches and adds movies, but the script also supports removing movies and optionally deleting associated files. This hidden destructive capability can mislead users or higher-level agents into invoking the skill in situations where they would not have granted deletion authority, increasing the risk of unauthorized or accidental data loss.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The add-collection flow silently changes collection state by enabling monitoring and searchOnAdd, which can cause future movies to be auto-added beyond the immediate user request. Because this persistence and ongoing automation are not disclosed in the skill description, users may unknowingly authorize continuing changes to their media library.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The remove command can delete media files immediately when passed --delete-files, with no confirmation, dry-run, or explicit warning. In an agentic context, a malformed instruction, prompt injection, or simple operator mistake could trigger irreversible deletion of downloaded content.
- Content
Static analysis
No suspicious patterns detected.