T09 · Insecure Skill Coding Practices
Error
- Location
scripts/yutori-research.mjs:13- Finding
Unvalidated API Base URL Can Expose Credentials and Research Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Yutori research
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible Yutori research helper, but it can send the API key and research prompts to any endpoint named in YUTORI_API_BASE, so it needs review before installation.
Install only if you intend to use Yutori's cloud service for the submitted research and browsing tasks. Set YUTORI_API_BASE only to an official HTTPS Yutori endpoint, avoid using it for confidential or internal URLs unless approved, and consider hardening the script to allowlist Yutori origins before sending the API key.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `yutori-research.mjs` — create + poll a research task; prints **pretty text** output.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `yutori-research.mjs` — create + poll a research task; prints **pretty text** output.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill uses sensitive capabilities (environment-derived API keys and outbound network access) but does not declare any explicit tool scope or permissions boundaries. This creates ambiguity about what the skill is allowed to access and increases the chance it will be invoked with broader privileges than necessary, especially in agent frameworks that rely on metadata for least-privilege enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation guidance is broad enough to match many generic research or browsing requests, which can cause the skill to activate in situations where users did not intend to send their queries or target URLs to an external cloud service. Because this skill transmits prompts and browsing tasks off-platform, overly broad triggers increase the risk of accidental data disclosure and inappropriate use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill does not clearly warn that user prompts, research topics, and browsing targets are sent to external Yutori cloud services. In a research/browsing skill, that omission is particularly risky because users may provide confidential topics, internal URLs, or sensitive instructions without realizing they will leave the local environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
The example explicitly sends task content and browsing targets to an external API endpoint using an API key, which is an external data transmission path. In context, external transmission is the core function of the skill, but it is still security-relevant because any sensitive user request, internal site URL, or extracted data could be exposed to a third-party service if used without adequate disclosure and consent.
- Content
Create a browsing task (example curl):
bash curl --request POST \ --url "$YUTORI_API_BASE/v1/browsing/tasks" \ --header "x-api-key: $YUTORI_API_KEY" \ --header "Content-Type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script transmits the user’s query together with location and timezone metadata to a remote Yutori API, but the runtime UX provides no explicit notice or confirmation before sending potentially sensitive research prompts off-host. In a research/browsing skill, queries may contain confidential business questions, personal data, or investigative targets, so silent transmission increases privacy and data-handling risk even if this is the tool’s expected function.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script injects default locale context (America/Los_Angeles and San Francisco, CA, US) even when the user did not supply it, which means extra contextual data is sent and may influence downstream browsing or research behavior without user consent. While not directly exploitable like code execution, it creates unnecessary privacy exposure and can bias results or misrepresent the user’s actual context.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/yutori-research.mjs:16