T09 · Insecure Skill Coding Practices
Warning
- Location
core/utils.py:13- Finding
Insufficient Task-Graph Validation Allows Workflow Denial of Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Workflow Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a broad but coherent task-planning skill with no evidence of hidden persistence, destructive behavior, credential theft, or exfiltration beyond its disclosed OpenAI planning dependency.
Install only if you are comfortable with a general-purpose task decomposition helper that may send task text to OpenAI during planning. Avoid entering secrets or confidential data, and require explicit confirmation before using it for repository cloning, external research, file changes, or other side-effecting work.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims to perform DAG-based orchestration, but the content only gives generic instructions to analyze repos, research topics, and generate reports without implementing or constraining a real dependency-graph workflow. This mismatch can cause the agent to invoke the skill for broad high-impact tasks and improvise behavior beyond the declared purpose, increasing the chance of unsafe tool use or overreach.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README states that the project uses the OpenAI API to plan and execute user tasks, but it does not disclose that user prompts, task graphs, and potentially propagated task context may be transmitted to an external third-party service. In an agent workflow system, that omission is security-relevant because users may supply sensitive data during planning or execution without understanding the data-sharing boundary.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation guidance is so broad that it could trigger on almost any multi-step request, including sensitive workflows involving code, external resources, or parallel actions. Overbroad invocation criteria increase the likelihood of the skill being selected in contexts where stronger safeguards, narrower tooling, or explicit user confirmation are required.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill normalizes impactful actions like cloning repositories and parallel task execution without warning about side effects, resource use, trust boundaries, or the need for user consent. In practice, that can lead to unreviewed access to untrusted code or external content and make unsafe actions appear routine.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The executor concatenates outputs from all dependency tasks and forwards that aggregate context directly into whichever tool name matches the task string. In a DAG executor, prior task results may contain sensitive user data, secrets, or tool-returned content, so this creates an implicit cross-tool data flow and potential exfiltration channel without any minimization, classification, or explicit user disclosure/consent.
- Content