T08 · Insecure Dependencies
Error
- Location
SKILL.md:35- Finding
Unpinned Remote Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Analytics Tracking Automation — GA4 + GTM Setup via AI
Security checks for vulnerabilities and agentic risk
Overview
The skill is transparent about automating GA4/GTM work, but it deserves review because it installs mutable remote tooling and stores a reusable GTM write credential locally.
Install only if you trust the `jtrackingai/analytics-tracking-automation` source and can verify what version is being installed. Run it in a controlled workspace, review every GTM account/container/workspace and publish prompt carefully, keep `credentials.json` out of shared folders and backups, and revoke/clear the OAuth token when the workflow is done or no longer trusted.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/output-contract.md:71- Finding
GTM Write-Scoped OAuth Refresh Token Is Stored as a Plaintext Artifact
- Content
View full analysis
/gtm-context.json` (per artifact) or `event-tracking auth-clear --output-root ` (every cached token under a root). - The file is gitignored; do not commit it, just as you would not commit `~/.config/gh/hosts.yml` or `~/.aws/credentials`. ``` ### Technical Analysis The workflow stores a reusable Google OAuth refresh token in `credentials.json` inside the normal per-site artifact directory. A Git ignore rule reduces accidental source-control exposure but does not encrypt the credential or protect it from: - Other local processes running under the same account. - Overly broad filesystem permissions. - Shared or archived ar ...[truncated 2278 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (12)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `schema_prepared` | approved `site-analysis.json` | `schema-context.json`, Shopify bootstrap artifacts when applicable | CLI-enforced | | `schema_approved` | `event-schema.json` | approved schema hash in `workflow-state.json`, schema restore snapshot, schema decision audit, and optional `event-spec.md` | CLI-enforced | | `gtm_generated` | approved `event-schema.json` | `gtm-config.json` | CLI-enforced | | `synced` | `gtm-config.json` | `gtm-context.json`, `credentials.json`, Shopify sync artifacts when applicable | CLI-enforced | | `verified` | `event-schema.json`, `gtm-context.json` | `preview-report.md`, `preview-result.json`, `tracking-health.json`, `tracking-health-history/` | CLI-enforced for command execution; release readiness is derived from tracking health | | `published` | `gtm-context.json`, non-blocking `tracking-health.json` unless forced | live GTM container version | human confirmation plus CLI execution |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `schema_prepared` | approved `site-analysis.json` | `schema-context.json`, Shopify bootstrap artifacts when applicable | CLI-enforced | | `schema_approved` | `event-schema.json` | approved schema hash in `workflow-state.json`, schema restore snapshot, schema decision audit, and optional `event-spec.md` | CLI-enforced | | `gtm_generated` | approved `event-schema.json` | `gtm-config.json` | CLI-enforced | | `synced` | `gtm-config.json` | `gtm-context.json`, `credentials.json`, Shopify sync artifacts when applicable | CLI-enforced | | `verified` | `event-schema.json`, `gtm-context.json` | `preview-report.md`, `preview-result.json`, `tracking-health.json`, `tracking-health-history/` | CLI-enforced for command execution; release readiness is derived from tracking health | | `published` | `gtm-context.json`, non-blocking `tracking-health.json` unless forced | live GTM container version | human confirmation plus CLI execution |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `schema_prepared` | approved `site-analysis.json` | `schema-context.json`, Shopify bootstrap artifacts when applicable | CLI-enforced | | `schema_approved` | `event-schema.json` | approved schema hash in `workflow-state.json`, schema restore snapshot, schema decision audit, and optional `event-spec.md` | CLI-enforced | | `gtm_generated` | approved `event-schema.json` | `gtm-config.json` | CLI-enforced | | `synced` | `gtm-config.json` | `gtm-context.json`, `credentials.json`, Shopify sync artifacts when applicable | CLI-enforced | | `verified` | `event-schema.json`, `gtm-context.json` | `preview-report.md`, `preview-result.json`, `tracking-health.json`, `tracking-health-history/` | CLI-enforced for command execution; release readiness is derived from tracking health | | `published` | `gtm-context.json`, non-blocking `tracking-health.json` unless forced | live GTM container version | human confirmation plus CLI execution |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `schema_prepared` | approved `site-analysis.json` | `schema-context.json`, Shopify bootstrap artifacts when applicable | CLI-enforced | | `schema_approved` | `event-schema.json` | approved schema hash in `workflow-state.json`, schema restore snapshot, schema decision audit, and optional `event-spec.md` | CLI-enforced | | `gtm_generated` | approved `event-schema.json` | `gtm-config.json` | CLI-enforced | | `synced` | `gtm-config.json` | `gtm-context.json`, `credentials.json`, Shopify sync artifacts when applicable | CLI-enforced | | `verified` | `event-schema.json`, `gtm-context.json` | `preview-report.md`, `preview-result.json`, `tracking-health.json`, `tracking-health-history/` | CLI-enforced for command execution; release readiness is derived from tracking health | | `published` | `gtm-context.json`, non-blocking `tracking-health.json` unless forced | live GTM container version | human confirmation plus CLI execution |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - The granted scope is GTM container read/write only. It is not a full-account token and cannot read mail, drive, contacts, or any other Google service. - The file is stored inside the per-site artifact directory on the user's machine and is read only by `sync`, `preview`, and `publish` when those commands call `googleapis.tagmanager`. It is never transmitted to any third-party service, telemetry endpoint, or this skill's authors. - Rotate or revoke at any time with `event-tracking auth-clear --context-file <artifact-dir>/gtm-context.json` (per artifact) or `event-tracking auth-clear --output-root <output-root>` (every cached token under a root). - The file is gitignored; do not commit it, just as you would not commit `~/.config/gh/hosts.yml` or `~/.aws/credentials`. ## Editing Between Steps
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Skill Map <!-- contract-generated:runtime-skill-map:start --> | Skill | Role | Use When | Typical Stop Point | | --- | --- | --- | --- | | `analytics-tracking-automation` | umbrella workflow router | the request is end-to-end, ambiguous, or spans multiple phases | whichever checkpoint matches the user intent |
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The skill instructs operators to run
npx skills add jtrackingai/analytics-tracking-automationwithout pinning an exact version or integrity-checked source. That allows whatever package/version resolves at execution time to be fetched and run, creating a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Rules: - Do not ask the user to choose between internal workflow metadata flags and `analyze`. - If intent is ambiguous, ask one short plain-language intake question using user-facing terms such as "new setup", "update existing tracking", "upkeep", "health audit", "analyze only", or "resume an existing run". - If the user gives a fresh URL and asks to set up tracking, default to `new_setup`. - If the user gives a fresh URL and only asks to inspect the site, analyze structure, or review current tracking signals, default to `analysis_only`.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill enables implicit invocation but does not define a narrowly scoped trigger boundary in this file, which can cause the agent to auto-route user requests into this skill when the match is only loosely related. Because this skill can initiate or resume multi-step GA4/GTM workflows, unintended invocation may lead to incorrect task execution, leakage of site or tracking context into the wrong workflow, or user confusion about why automation started.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 73% confidence
- Finding
The document specifies persistent storage of an OAuth refresh token in a per-site artifact directory on disk for reuse by multiple commands. Even with benign intent and limited scope, persistent bearer-token storage increases exposure to local compromise, accidental inclusion in backups/artifacts, or leakage through weak filesystem permissions and shared workspaces.
- Content
md `credentials.json` is a user-owned credential artifact, handled the same way command-line tools like `gh` and `aws` handle local tokens: - The token is produced by the user completing Google's own OAuth consent screen interactively; the skill never reads, scrapes, or derives it from anywhere else. - The granted scope is GTM container read/write only. It is not a full-account token and cannot read mail, drive, contacts, or any other Google service. - The file is stored inside the per-site artifact directory on the user's machine and is read only by `sync`, `preview`, and `publish` when those commands call `googleapis.tagmanager`. It is never transmitted to any third-party service, telemetry endpoint, or this skill's authors. - Rotate or revoke at any time with `event-tracking auth-clear --context-file <artifact-dir>/gtm-context.json` (per artifact) or `event-tracking auth-clear --output-root <output-root>` (every cached token under a root). - The file is gitignored; do not commit it, just as you would not commit `~/.config/gh/hosts.yml` or `~/.aws/credentials`.
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown states that groups reflect the site's main language and that other language versions may not fully appear. This is a language/locale constraint expressed as guidance, but it does not offer the user a choice or explicit opt-in for handling multilingual sites differently.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phrase "Use this as a generic English template" imposes a specific language in the report template. Under the policy criteria, forcing a language without user opt-in or a documented regional/compliance justification is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.