T08 · Insecure Dependencies
Warning
- Location
references/BAML-REFERENCE-SOURCE.md:13- Finding
Unpinned Third-Party Packages and CLI Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
baml-codegen
Security checks for vulnerabilities and agentic risk
Overview
This BAML code-generation skill is mostly coherent, but it needs review because its mandatory generation workflow can execute project-defined shell hooks and its examples under-scope sensitive data handling.
Review this skill before installing. If used, inspect `baml_src/generators.baml` before every generation run, avoid or explicitly approve `on_generate` hooks, run code generation in a low-privilege sandbox, pin BAML package and CLI versions, and do not send invoices, receipts, resumes, images, chat history, or other sensitive data to external model providers without consent, redaction, retention controls, and appropriate provider approval.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
references/BAML-REFERENCE-SOURCE.md:86- Finding
Mandatory Code Generation Can Execute Repository-Controlled Shell Hooks
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/examples.md:109- Finding
File-Upload Integrations Lack Validation and Resource Limits
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/languages-typescript.md:602- Finding
Validation Error Handling Logs Full Prompts and Raw Model Responses
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (44)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ ├── sync_client.py │ └── async_client.py ├── pyproject.toml └── .env
text ## Import Pattern
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ ├── sync_client.py │ └── async_client.py ├── pyproject.toml └── .env
text ## Import Pattern
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ ├── sync_client.py │ └── async_client.py ├── pyproject.toml └── .env
text ## Import Pattern
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ ├── sync_client.py │ └── async_client.py ├── pyproject.toml └── .env
text ## Import Pattern
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation strongly instructs users to run automatic code generation and later shows an
on_generatehook that can execute arbitrary shell commands, but it does not prominently warn that these steps write files and may execute commands on the host. In an agent-skill context, that omission matters because an agent or user could treat.bamlcontent as declarative-only while generation can trigger filesystem modifications and post-generation command execution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These examples demonstrate sending user prompts, conversation history, and dynamically selected model inputs to external LLM providers, but they do not clearly warn that supplied content may leave the local trust boundary. In documentation for a code-generation skill, omission of a data-transmission warning can lead developers to unknowingly route sensitive user or business data to third-party services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The multimodal examples show images, audio, PDFs, invoices, and organizational documents being sent to external models without any notice that these files may contain sensitive personal, financial, or corporate information. Because multimodal inputs often embed high-risk data, the missing warning materially increases the chance of unintended disclosure through copy-pasted example usage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invoice extraction example sends raw invoice text, which may contain sensitive financial and personal data, to an external OpenAI-hosted model without any privacy notice, consent guidance, or data-minimization warning. Users may copy this pattern directly into production and unintentionally transmit regulated or confidential data to third-party services under inappropriate retention or compliance assumptions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a skill for generating BAML code from natural-language requirements, but this example code implements a runnable research agent workflow that executes planned actions such as web and paper searches. While generating example integrations is in scope, embedding operational agent execution logic introduces capabilities not justified by a code-generation skill's stated purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The receipt image workflow uploads user-provided images and extracted purchase information to an external vision model without disclosing that third-party processing occurs. Receipt images can contain names, card details, merchant history, and location/time data, so omission of privacy and handling guidance creates a realistic risk of unintended sensitive-data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation encourages use of
on_generateshell hooks and provides examples that automatically run commands such as formatters, dependency updates, and auto-fixers. While not overtly malicious, this is risky because readers may copy these settings without understanding thatbaml-cli generatewill execute arbitrary shell commands, potentially modifying files, dependency state, or CI environments whenever generation runs.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The examples encourage fetching images from external URLs and local file paths without warning that doing so may transmit sensitive data to remote model providers or expose local files unintentionally. In an agent/codegen context, users may copy these patterns directly into production workflows, making silent data exfiltration more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The ClientRegistry example shows dynamic provider configuration and API-key-backed LLM calls but omits any notice that prompt data may be sent to third-party services. In a code-generation skill, this can normalize unsafe integration patterns where sensitive application data is routed externally without clear disclosure or policy checks.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.