T09 · Insecure Skill Coding Practices
Error
- Location
examples/trust-check.sh:15- Finding
Arbitrary Python Code Execution Through AUID Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
AXIS TrustLayer AgentFICO
Security checks for vulnerabilities and agentic risk
Overview
The skill’s AXIS API purpose is mostly disclosed, but its executable examples handle session cookies and user input unsafely enough that users should review it before installing or running it.
Install only if you trust AXIS and need these API workflows. Prefer the Python lookup example over the shell lookup script, avoid pasting live session cookies into command lines or chats, and treat registration, event submission, API key creation, and key revocation as account-sensitive actions requiring explicit review.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/register-agent.sh:19- Finding
Unsafe JSON Construction in Agent Registration Request
- Content
View full analysis
- Remediation
View remediation
&2; exit 2 ;; esac PAYLOAD=$(python3 -c ' import json import sys print(json.dumps({ "json": { "name": sys.argv[1], "agentClass": sys.argv[2], } })) ' "$AGENT_NAME" "$AGENT_CLASS") RESPONSE=$(curl -sf -X POST "$BASE_URL/agents.register" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ --data-binary "$PAYLOAD") ``` Also enforce the documented name length, reject control characters where appropriate, and test values containing quotes and backslashes. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/submit-event.sh:26- Finding
Unsafe JSON and Numeric-Field Construction in Behavioral Event Submission
- Content
View full analysis
- Remediation
View remediation
&2 exit 2 } [[ "$SCORE_IMPACT" =~ ^-?[0-9]+$ ]] || { echo "Score impact must be an integer" >&2 exit 2 } (( SCORE_IMPACT >= -100 && SCORE_IMPACT <= 100 )) || { echo "Score impact must be between -100 and 100" >&2 exit 2 } ``` 2. Enforce the documented event-type allowlist with a `case` statement. 3. Generate the complete payload with Python `json.dumps` or `jq -n`. 4. Pass numeric values to the serializer and explicitly convert them to integers. 5. Add tests for quotes, backslashes, newlines, duplicate-field attempts, nonnumeric IDs, and out-of-range scores. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/register-agent.sh:3- Finding
AXIS Session Cookie Exposed Through Registration Command Arguments
- Content
View full analysis
# Example: ./register-agent.sh "session=abc123" "My Research Agent" "research" # # Agent classes: enterprise, personal, research, service, autonomous # Requires authentication (session cookie from https://axistrust.io). set -euo pipefail SESSION_COOKIE="${1:?Usage: $0 }" ``` The cookie is subsequently passed to `curl` as a header: ```bash -H "Cookie: $SESSION_COOKIE" \ ``` ### Technical Analysis The example instructs users to supply an active session cookie as a command-line argument. Command-line arguments can be retained in shell history and may be visible to local process-inspection facilities while the command is running. The cookie is also placed in the `curl` argument vector when the child process is created. A session cookie is a bearer credential: possession may be sufficient to perform operations as the authenticated user until the session expires or is revoked. ### Attack Path 1. A user copies an active AXIS session cookie into the example command. 2. The shell records the command in history, or a local process observes the script or `curl` argument list. 3. The observer extracts the cookie value. 4. The observer replays the cookie in requests to AXIS. 5. The attacker performs operations allowed by the compromised session, subject to server-side expiration and authorization. ### Impact Assessment A stolen session may permit unauthorized authenticated API operations, including agent registration and any other operation available to that AXIS account. The issue does not cross operating-system privilege boundaries by itself; exploitation requires access to command history, process metadata, term ...[truncated 42 chars]- Remediation
View remediation
&2 exit 2 } curl -sf --cookie "$COOKIE_FILE" ... ``` 3. Alternatively, read the secret through a hidden prompt, while ensuring it is not subsequently included literally in a child process's argument vector. 4. Remove real-cookie patterns from usage examples. 5. Recommend short-lived sessions, prompt revocation after exposure, and avoid logging request headers. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/submit-event.sh:3- Finding
AXIS Session Cookie Exposed Through Event-Submission Command Arguments
- Content
View full analysis
# Example: ./submit-event.sh "session=abc123" 42 "task_completed" 10 "Completed data analysis accurately" # # agent_id: numeric integer (from agents.register or agents.list response) # event_type: task_completed | task_failed | security_pass | security_fail | # compliance_pass | compliance_fail | user_feedback_positive | # user_feedback_negative | peer_feedback_positive | peer_feedback_negative | # incident_reported | incident_resolved | adversarial_detected # score_impact: integer from -100 to +100 # Requires authentication (session cookie from https://axistrust.io). set -euo pipefail SESSION_COOKIE="${1:?Usage: $0 }" ``` The cookie is subsequently included in a `curl` header argument: ```bash -H "Cookie: $SESSION_COOKIE" \ ``` ### Technical Analysis Supplying a bearer session cookie as a positional argument risks disclosure through shell history, process listings, terminal capture, debugging output, or command auditing. The credential also becomes part of the `curl` child process's argument vector. This exposure is unnecessary for the declared event-submission functionality because `curl` can consume a protected cookie file instead. ### Attack Path 1. The user invokes `submit-event.sh` with a live AXIS session cookie. 2. The command is recorded in history or observed through local process inspection. 3. An attacker with access to that data recovers the cookie. 4. The attacker replays the cookie against authenticated AXIS endpoints. 5. Unauthorized behavioral events or other account-authorized actions are submitted befor ...[truncated 394 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
examples/trust-check.py:8- Finding
Unpinned Third-Party Python Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh echo "Registering agent: $AGENT_NAME (class: $AGENT_CLASS)" echo "" RESPONSE=$(curl -sf -X POST "$BASE_URL/agents.register" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ -d "{\"json\":{\"name\":\"$AGENT_NAME\",\"agentClass\":\"$AGENT_CLASS\"}}")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh echo "Submitting event for agent ID $AGENT_ID: $EVENT_TYPE (impact: $SCORE_IMPACT)" echo "" RESPONSE=$(curl -sf -X POST "$BASE_URL/trust.addEvent" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ -d "{\"json\":{\"agentId\":$AGENT_ID,\"eventType\":\"$EVENT_TYPE\",\"category\":\"submitted_via_skill\",\"scoreImpact\":$SCORE_IMPACT,\"description\":\"$DESCRIPTION\"}}")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh echo "Looking up agent: $AUID" echo "" RESPONSE=$(curl -sf "$BASE_URL/agents.getByAuid?input=$INPUT") # Parse and display key fields echo "$RESPONSE" | python3 -c "
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill demonstrates network and shell-capable behavior via multiple curl examples but does not declare any tool scope or allowed-tools restrictions. This weakens least-privilege controls and could let an agent invoke broader execution or outbound network actions than users expect when installing or reviewing the skill.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Look up an agent by AUID — replace AGENT_AUID_HERE with the actual AUID string # Input must be URL-encoded JSON with a "json" wrapper curl -s "https://www.axistrust.io/api/trpc/agents.getByAuid?input=%7B%22json%22%3A%7B%22auid%22%3A%22AGENT_AUID_HERE%22%7D%7D"The response includes the agent's name, T-Score, C-Score, trust tier, registration date, agent class, and foundation model.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The authenticated examples instruct use of session cookies and later API-key operations but do not explicitly warn users not to expose, log, or share those credentials. In agent environments, examples are often copied verbatim, so absent handling guidance can lead to credential leakage through prompts, logs, chat history, or screenshots.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # agentId is a numeric integer curl -s "https://www.axistrust.io/api/trpc/credit.getScore?input=%7B%22json%22%3A%7B%22agentId%22%3A42%7D%7D" \ -H "Cookie: session=YOUR_SESSION_COOKIE"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's stated purpose is trust lookup and reputation verification, but it also includes API key listing, creation, and revocation flows. Secret-management operations are more sensitive than read-only trust checks and expand the blast radius if the skill is misused, compromised, or invoked in an unexpected context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script requires a live session cookie as a positional argument and then uses it directly for authentication to a remote service. Supplying credentials on the command line is risky because they can be exposed via shell history, process listings, audit logs, or copied usage examples, making credential theft more likely even if the network transport is HTTPS.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
This script transmits an authentication cookie to an external endpoint, which is expected for its function, but it still creates a real credential exposure boundary. If the endpoint, DNS resolution, local environment, or logs are compromised, the session cookie could be reused to impersonate the user and perform authenticated actions.
- Content
sh echo "Registering agent: $AGENT_NAME (class: $AGENT_CLASS)" echo "" RESPONSE=$(curl -sf -X POST "$BASE_URL/agents.register" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ -d "{\"json\":{\"name\":\"$AGENT_NAME\",\"agentClass\":\"$AGENT_CLASS\"}}")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "Submitting event for agent ID $AGENT_ID: $EVENT_TYPE (impact: $SCORE_IMPACT)" echo "" RESPONSE=$(curl -sf -X POST "$BASE_URL/trust.addEvent" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ -d "{\"json\":{\"agentId\":$AGENT_ID,\"eventType\":\"$EVENT_TYPE\",\"category\":\"submitted_via_skill\",\"scoreImpact\":$SCORE_IMPACT,\"description\":\"$DESCRIPTION\"}}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script sends the user-supplied AUID to a third-party API endpoint without any explicit consent prompt, privacy warning, or note about data disclosure. Even if the endpoint is intended for public lookups, AUIDs may still identify internal agents, relationships, or operational activity, so transmitting them off-host can leak sensitive metadata.
- Content