T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/src/geocode.js:14- Finding
Precise User Address and Coordinates Persisted in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
Lieferando Cli
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a coherent food-delivery lookup tool, but it should be reviewed because it stores searched addresses and coordinates on disk without clear user-facing notice or cleanup.
Install only if you are comfortable with a local CLI sending delivery addresses to OSM for geocoding and retaining searched addresses and coordinates in a plaintext cache under your home directory. Prefer using postcodes or coordinates instead of full home/work addresses when possible, and manually remove the cache if you do not want that location history retained.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description repeatedly frames the skill as read-only discovery, but the documented cart commands create and persist local state and perform checkout-style simulations. Even if no real order is placed, this mismatch can mislead users, reviewers, or orchestration systems into approving a skill with broader behavior than declared, including local file writes and stateful actions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises executable Node-based functionality that necessarily uses network access and may access environment/runtime state, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a policy gap: the host may grant broader capabilities than users or reviewers expect, increasing the chance of unintended network access or ambient data exposure if the bundled script changes or is abused.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest says to trigger when asked to 'find food, compare delivery options, or resolve menu/item details,' which is broad natural language that overlaps with everyday requests. Although providers and geography are mentioned, there is no explicit boundary or negative examples clarifying when general food questions should not invoke this skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest frames the skill as read-only restaurant and menu discovery, but this file creates, updates, and deletes a persistent cart.json on disk. Even though comments stress that it is only a local simulation and not a real platform basket, maintaining mutable cart state goes beyond pure read-only discovery behavior described in the manifest.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI exposes
cart add,cart clear, and related state-changing commands even though the skill metadata and usage text describe the tool as read-only discovery only. Even if the cart is only local simulation, this still violates the declared security boundary and can mislead downstream agents or users into invoking mutation-capable behavior they would otherwise avoid.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The usage text says
cart previewis local arithmetic, but the implementation callscartPreview(provider, loc), which is provider-backed and may perform network-dependent logic. This discrepancy weakens trust assumptions: an orchestrating agent may permit the command believing it is purely local, while it can actually reach external providers and expose location or cart details.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest frames the skill as read-only food-delivery discovery, but this module writes a persistent cache file under the user's home directory. While the network geocoding itself supports the stated purpose, local stateful disk writes are additional behavior not conveyed by the description's read-only framing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code caches resolved address data, including coordinates, postcode, and display name, to disk without any visible notice in this file. Local persistence of location data can expose sensitive user information to other local users, backups, or forensic recovery, especially when addresses correspond to residences.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The geocoding function defaults to
countryCodes = 'de', and related validation/messages assume German postcodes, which imposes a specific locale constraint. In this file, that restriction is not presented as a user-selectable option or clearly justified as a region-specific tool.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function sends the user's free-text address to the external Nominatim service, which is a privacy-relevant disclosure of potentially sensitive location data. In a food-discovery skill this is functionally necessary, but absent clear disclosure/consent and data-handling transparency, users may unknowingly transmit home or work addresses to a third party.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code requires a 5-digit postcode and tells the user it must be a German postcode, which is a locale policy constraint expressed in user-facing natural language. This file does not offer an alternative locale choice or clearly document that the skill is intentionally limited to Germany.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This module consults process.env for a cache directory override and creates/writes files in that directory. For a skill described primarily as read-only restaurant/menu discovery with JSON output, environment inspection and filesystem mutation are auxiliary capabilities that are not explicitly declared in the stated purpose.
- Content