T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:67- Finding
API Credentials May Be Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
Shipp enables a faster way to create connections to real-time data. It's cost-effective, fast to run, and easy to start.
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Shipp API integration, but its docs include unsafe credential handling and an optional unpinned trading-bot setup that asks for multiple sensitive API keys.
Install only if you need Shipp API integration and are comfortable sending requests to Shipp. Prefer header-based API keys, do not put keys in URLs, treat the README key as unsafe placeholder text, and avoid running the Alph Bot example unless you first review or pin the repository and use limited test credentials in paper/demo mode.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Error
- Location
README.md:67- Finding
Unpinned External Repository Is Cloned and Executed with Sensitive Credentials
- Content
View full analysis
``` ``` ### Technical Analysis The documentation directs users to clone the current state of an external Git repository, add several sensitive API credentials, and execute its migration and runtime commands. No immutable commit hash, signed release, checksum, dependency verification, or code-review step is specified. Because the repository reference is mutable, the code executed by future users can differ from the code that existed when this Skill was reviewed. The effective payload also includes package-manager dependencies, lifecycle scripts, migration logic, and the executable entry point. A compromise of the upstream repository, maintainer account, package registry, or transitive dependency could therefore introduce arbitrary code. This external project is presented as an example and is not required to invoke the Shipp API. Directly cloning and executing it consequently exceeds the minimum privileges and dependencies necessary for the Skill's core real-time data connector functionality. The exposure is amplified because users are instructed to place Shipp, Kalshi, and Anthropic credentials in the execution environment. The project can also interact with financial trading services when paper mode is not used. ### Attack Path 1. An attacker compromises the external repository, a maintainer account, or one of the repository's direct or transitive dependencies. 2. The attacker inserts malicious code into a packag ...[truncated 1483 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md git clone https://gitlab.com/outsharp/shipp/alph-bot.git cd alph-bot cp .env.example .env # Add your Shipp, Kalshi, and Anthropic API keys yarn migrate
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README shows what appears to be a realistic Shipp API key value in an environment variable example. If this is a real or accidentally valid credential, it could be harvested from public documentation and used to access the Shipp account, consume credits, or retrieve data; even if not real, publishing live-looking secrets normalizes unsafe key-handling practices.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents running 'Alph Bot' with Shipp, Kalshi, and Anthropic API keys and shows a command that performs automated value betting. While it warns about real money outside demo mode, it does not clearly disclose privacy/system-impact behaviors such as sending data to third-party services and executing automated trading actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The allowed tools explicitly permit outbound curl requests to external Shipp domains, enabling transmission of user queries, API credentials, and retrieved data to a third-party network location. In this skill that behavior is expected, but without an explicit user-facing disclosure and data-minimization guidance it still represents a real external-transmission risk.
- Content
md allowed-tools: - Bash(curl:https://docs.shipp.ai/*) - Bash(curl:https://api.shipp.ai/*) - Bash(curl:https://platform.shipp.ai/*) - Bash(jq:*)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The documented base API prefix directs all operational requests to an external Shipp API endpoint, meaning any request content and authentication material will leave the local environment. This is normal for an integration skill, but it is still security-relevant because the skill does not pair the instruction with a clear warning about third-party transmission and credential exposure risks.
- Content
md Base prefix: - All routes are under: `https://api.shipp.ai/api/v1` ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill clearly instructs use of a third-party API and lists multiple authentication methods, but it does not warn users that their API key and any queried data will be transmitted to Shipp-operated external services. This creates a consent and data-handling transparency gap that can expose sensitive prompts, identifiers, or usage patterns to an external provider without an explicit user warning.
- Content