T09 · Insecure Skill Coding Practices
Warning
- Location
utils.py:22- Finding
Insecure Storage and Transmission of Bearer Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
trailsnap-cli
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a TrailSnap photo CLI, but it can delete photos and overwrite local files without adequate safeguards while storing API tokens in plaintext.
Review carefully before installing. Use only a least-privilege TrailSnap token, avoid non-local HTTP endpoints, protect or rotate the token because it is stored in plaintext, and do not allow an agent to run photos delete or medias get --format file without explicit human approval and a safe output path.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
commands/medias.py:43- Finding
Caller-Controlled Media Output Path Allows Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill presented as a viewing/query tool reportedly also supports photo deletion, which is a destructive operation inconsistent with user expectations. Hidden destructive capability raises the risk of accidental or unauthorized data loss if the skill is invoked under a read-only trust model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A skill presented as a viewing/query tool reportedly also supports photo deletion, which is a destructive operation inconsistent with user expectations. Hidden destructive capability raises the risk of accidental or unauthorized data loss if the skill is invoked under a read-only trust model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A skill presented as a viewing/query tool reportedly also supports photo deletion, which is a destructive operation inconsistent with user expectations. Hidden destructive capability raises the risk of accidental or unauthorized data loss if the skill is invoked under a read-only trust model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A skill presented as a viewing/query tool reportedly also supports photo deletion, which is a destructive operation inconsistent with user expectations. Hidden destructive capability raises the risk of accidental or unauthorized data loss if the skill is invoked under a read-only trust model.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata states this CLI is intended for querying and viewing photo-related information, but the code exposes a delete subcommand that performs a destructive action. This capability mismatch is dangerous because a caller, reviewer, or higher-level agent may trust the skill as read-only and invoke it in contexts where deletion is unexpected, enabling unauthorized or accidental data loss.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The delete handler directly issues a DELETE request for a user-supplied photo ID even though the skill is presented as a query/view tool. In agentic environments, unjustified destructive functionality increases the chance of misuse or prompt-confusion attacks leading to irreversible deletion of user content.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The examples document a destructive
photos deletecommand even though the skill metadata presents the tool as a read/query interface for viewing photo and album information. This mismatch can mislead an agent or user into invoking deletion in a context where only non-destructive operations were expected, increasing the risk of unintended data loss.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 72% confidence
- Finding
The code stores and loads a bearer token from a plaintext .env file in the skill directory, which creates a credential exposure risk if the filesystem is readable by other local users, included in backups, or accidentally committed to source control. In this skill context, the token grants access to TrailSnap API data, so compromise could expose photo, album, location, and people metadata.
- Content
python from pathlib import Path from urllib.parse import urlencode ENV_FILE = Path(__file__).parent / ".env" def load_env(): if not ENV_FILE.exists():
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises executable CLI behavior with file read, file write, and network access, but does not declare any tool scope or permission boundaries. This increases the chance that an agent can invoke broader capabilities than users expect, especially since the skill also configures credentials and persists them locally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to store an API token in a local .env file without guidance on file permissions, secure storage, rotation, or avoiding accidental disclosure. Tokens stored this way are at risk of being read by other tools, committed to source control, or exposed through logs and backups.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill is used to query photos, albums, tags, locations, and people information. This file adds a
config setcommand that accepts an API URL and bearer token and persists them viasave_env, which is configuration/credential management rather than querying photo data.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The command accepts an API token and immediately persists it via
save_env(args.url, args.token)without any visible confirmation prompt, print/log message, or inline comment/docstring explaining that credentials will be written to storage. For a code file, storing sensitive credentials without any user disclosure matches the missing user warning criterion.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill's user-facing help text and status messages are written only in Chinese, which imposes a specific language on users without any opt-in, fallback, or documented regional restriction. This matches the policy category for language/locale constraints in natural-language content within code files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI help text and status messages are written exclusively in Chinese, which imposes a specific language on all users with no opt-in or fallback. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale limitation is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code sends user-supplied location timeline and date-range parameters to backend endpoints via make_request, but there is no confirmation prompt, warning message, or explanatory comment indicating that potentially sensitive location-related data will be transmitted. Because location history is privacy-sensitive, the absence of any user disclosure is a quality/safety concern for a code file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a CLI for querying photos, albums, tags, locations, and people information, which implies read/query operations. This command includes a
fileoutput mode that downloads raw media content and writes it to an arbitrary local path, going beyond simply viewing or querying metadata/data in the CLI output.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill's stated purpose is to query and view photo and album information. Allowing the caller to provide any output path and writing downloaded bytes there introduces a filesystem write capability that is not obviously required for a query-focused CLI.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This code performs a file write operation when
format == "file", but there is no warning, confirmation, or pre-action user-facing disclosure that data will be saved to the provided path. The only message appears after the write completes, which does not warn the user before affecting the filesystem.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The command help text and user-facing messages are written in Chinese throughout the file, with no indication that the skill is region-specific or that users can choose another language. This creates a natural-language locale policy concern because the skill enforces a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code performs photo deletion immediately without any warning, dry-run, or confirmation step. That makes accidental invocation or unsafe agent behavior more likely to cause irreversible loss, especially when commands may be composed from ambiguous user instructions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation exposes a destructive delete operation without any warning, confirmation step, or note about irreversible consequences. In an agent setting, examples strongly influence tool use, so presenting deletion as a routine command can cause accidental execution and permanent removal of user photos.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is described as a query/viewing tool, but its documented command set also includes
photos delete, which expands it from read-only access into destructive capability. This mismatch can cause an agent or user to invoke a deletion action in a context where only retrieval was expected, increasing the risk of unintended data loss.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Documenting a delete command without any warning, confirmation, or safety note makes accidental destructive use more likely, especially when consumed by automation or an agent. In this skill's context, photo deletion is more dangerous because the tool otherwise appears oriented toward information retrieval, so a mutating operation may be invoked without appropriate caution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The
config setoperation accepts an API URL and bearer token, but the manifest gives no warning that credentials may be stored locally or transmitted to a remote server. This can lead users or agents to handle secrets unsafely, especially if pointed at non-HTTPS endpoints such as the providedhttp://localhost:8000example pattern.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest exposes a destructive
photos deletecapability and even includes an example invocation, but provides no warning, confirmation requirement, or indication that this operation is irreversible. In an agent setting, this increases the chance of accidental or prompt-induced destructive actions against user photo data.- Content
Static analysis
No suspicious patterns detected.