T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pipeline_monitor.py:38- Finding
GitLab API token can be transmitted to an arbitrary or plaintext endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
CI/CD Pipeline Toolkit
Security checks for vulnerabilities and agentic risk
Overview
This CI/CD skill is mostly purpose-aligned, but it needs Review because it can handle deployment automation and CI credentials without enough safeguards.
Review this skill before installing. Use only narrowly scoped, short-lived GitHub or GitLab tokens, avoid passing tokens on the command line, do not use untrusted or plaintext GitLab URLs, and inspect generated CI/CD files before committing them or letting them affect production deployments.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded dependencies and mutable CI component references create supply-chain exposure
- Content
View full analysis
=6.0 requests>=2.28.0 python-jenkins>=1.8.0 ``` `scripts/github_workflow_generator.py`: ```python "steps": [ {"uses": "actions/checkout@v4"}, {"uses": "actions/setup-python@v4", "with": {"python-version": "${{ matrix.python-version }}"}}, {"name": "Install dependencies", "run": "pip install -r requirements.txt"}, {"name": "Run linting", "run": "flake8 src/"}, {"name": "Run tests", "run": "pytest --cov=src --cov-report=xml"}, {"name": "Upload coverage", "uses": "codecov/codecov-action@v3", "with": {"file": "./coverage.xml"}} ] ``` ```python "steps": [ {"uses": "actions/checkout@v4"}, {"name": "Set up Docker Buildx", "uses": "docker/setup-buildx-action@v3"}, {"name": "Login to Docker Hub", "uses": "docker/login-action@v3", "with": {"username": "${{ secrets.DOCKER_USERNAME }}", "password": "${{ secrets.DOCKER_PASSWORD }}"}}, {"name": "Build and push", "uses": "docker/build-push-action@v5", "with": {"context": ".", "push": True, "tags": "${{ secrets.DOCKER_USERNAME }}/app:${{ github.sha }}"}} ] ``` `scripts/gitlab_ci_generator.py` uses mutable container tags: ```python "image": "python:3.11", ``` The same mutable image reference appears in the generated build, test, and deployment jobs. ### Technical Analysis The Python requirements use minimum-version constraints without upper bounds, hashes, or a lock file. A future installation can therefore resolve materially different dependency versions without any change to this project. The generated GitHub workflows refer to Actions through mutable major-version tags such as `@v3`, `@v4`, and `@v5`. GitLab jobs simila ...[truncated 2000 chars]- Remediation
View remediation
``` 5. Preserve the human-readable release version in comments and use an automated update service to propose reviewed SHA updates. 6. Pin container images by digest: ```yaml image: python:3.11@sha256: ``` 7. Apply least privilege to generated workflow permissions and use short-lived, narrowly scoped CI credentials. 8. Regularly scan locked dependencies, Action commits, and container digests for known vulnerabilities. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes a deployment_trigger capability that can target production but does not include any explicit warning, confirmation, or safety guidance for production-affecting actions. In a CI/CD context, triggering deployments is inherently high-trust and can cause service disruption, unintended releases, or operational impact if invoked carelessly or through ambiguous user intent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python if token: headers["Authorization"] = f"token {token}" url = f"https://api.github.com/repos/{repo}/actions/runs" try: response = requests.get(url, headers=headers)
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents automated deployment and CI/CD configuration generation as core features, and the examples later save workflow files into repository paths. The description does not include any user warning that these actions can alter build/deployment behavior or commit-worthy project files, which is relevant to user data and system integrity.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The examples save workflow and CI configuration files directly to standard repository paths without warning that existing files may be created or overwritten. In practice this can unintentionally replace repository automation, alter build behavior, or introduce deployment changes, especially because CI/CD config files are security- and release-sensitive.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency is specified with a minimum version only, so builds may resolve to different releases over time. That weakens reproducibility and can unintentionally introduce a vulnerable or incompatible PyYAML version into downstream environments.
- Content
text PyYAML>=6.0 requests>=2.28.0 python-jenkins>=1.8.0
Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
PyYAML has multiple known advisories, and because the manifest does not pin a version, there is no way to verify whether deployments will receive a fixed or vulnerable release. This is more concerning because PyYAML has a history of unsafe parsing/deserialization issues, which can become serious if the application ever processes untrusted YAML.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using a non-exact version for requests allows future installations to pull in any newer release that satisfies the range. This creates supply-chain and reproducibility risk because a newly introduced vulnerable or behavior-changing version could be installed without code changes.
- Content
text PyYAML>=6.0 requests>=2.28.0 python-jenkins>=1.8.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
Requests has numerous historical advisories, and the unpinned requirement prevents verification that an installed version is patched. If this skill makes outbound HTTP requests, a vulnerable requests release could expose credentials, mishandle redirects, or weaken transport security depending on the affected version.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
An unpinned python-jenkins dependency means the installed package version is not deterministic and may change between builds. Because this library may interact with CI/CD infrastructure, unexpected updates could increase operational and security risk if a bad release or vulnerable version is resolved.
- Content
text PyYAML>=6.0 requests>=2.28.0 python-jenkins>=1.8.0
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s user-facing title and multiple docstrings are written in Chinese alongside English, but there is no indication that language selection is optional or that the skill is intended only for a Chinese-speaking context. This creates a natural-language locale constraint without explicit user opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file mixes English and Chinese in docstrings and descriptions, while several user-facing help strings and output messages are fixed rather than selectable by the user. This can violate language/locale policy when a skill imposes a language presentation without explicit opt-in or configuration.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The save method opens the target path in write mode, which will overwrite an existing file, but there is no confirmation prompt or pre-write warning. Although the script prints a success message afterward, it does not disclose this destructive behavior before performing the write.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code includes user-facing natural-language strings such as docstrings in Chinese (e.g. the function descriptions) while the skill does not provide any explicit user opt-in or language-selection mechanism. That can violate language/locale policy when a skill implicitly forces a language for some users.
- Content
Static analysis
No suspicious patterns detected.