T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:140- Finding
Unvalidated Jenkins URL Enables Credential Disclosure and Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Jenkins
Security checks for vulnerabilities and agentic risk
Overview
This Jenkins helper has a coherent purpose, but it can send Jenkins credentials to project-configured URLs without validating or clearly confirming the destination first.
Review before installing. Use only with trusted PROJECTS.md entries, least-privileged Jenkins API tokens, HTTPS-only Jenkins URLs, and a host allowlist or explicit host confirmation before any authenticated request. Avoid broad auto-invocation for generic words like build, and treat PROJECTS.md edits as security-sensitive configuration changes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The auto-trigger entry criteria are overly broad, causing the skill to activate on generic terms like 'build' or 'jenkins'. In a CI/CD context, mistaken invocation can lead to unintended project lookup, disclosure of project metadata, and progression toward triggering real builds against Jenkins infrastructure.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md A modular skill package for interacting with Jenkins via REST API. Each feature can be called independently, and AI will guide you step by step. **Interaction rule:** All user selections and inputs MUST use the `question` tool with interactive buttons. Users can scroll through options or type directly in the input box (e.g., enter an ID). Never ask the user to type commands or names manually. ### Prerequisites
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The overview states that all user selections and inputs must use the question tool and that users should never be asked to type commands or names manually. However, the configuration steps explicitly ask the user to enter a project name, source repository URL, and Jenkins URL, which contradicts that stated interaction rule.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill states that Jenkins credentials are required but does not clearly warn that they will be used in outbound authenticated requests to URLs sourced from PROJECTS.md. Because the Jenkins URL is taken from mutable project records, this increases SSRF-like risk and could cause authenticated requests to attacker-controlled or untrusted endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill allows creating and updating PROJECTS.md without clearly warning users that local configuration files will be modified. In agent environments, silent writes to workspace files can alter future behavior, poison project metadata, or persist attacker-influenced endpoints for later network actions.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description scopes the skill to interacting with Jenkins via REST API for triggering builds, listing projects, and checking results. The documented behavior includes creating and updating local project configuration records in PROJECTS.md, which is a separate file-management capability not reflected in the manifest description.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill documentation defines only Feature 1 and Feature 2, but the FAQ instructs the user to use Feature 3 to list all projects. This is an active documentation contradiction that can mislead users about the skill's actual capabilities.
- Content