T09 · Insecure Skill Coding Practices
Error
- Location
scripts/list-all-flows.sh:10- Finding
Arbitrary Command Execution Through Sourced Configuration File
- Content
View full analysis
- Remediation
View remediation
Security audit
openc3-flow
Security checks for vulnerabilities and agentic risk
Overview
This is a simple Open-C3 flow-listing skill, but it asks for an API key and can expose or execute sensitive configuration if set up insecurely.
Review before installing. Use only a trusted Open-C3 endpoint, configure OPEN_C3_URL with HTTPS, use a least-privileged read-only APP_KEY if possible, keep config.env private with restrictive permissions, and do not use a config.env file supplied by an untrusted party without inspecting it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/list-all-flows.sh:24- Finding
Open-C3 Credentials Can Be Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes shell commands via curl/jq but does not declare any tool restrictions such as permissions or allowed-tools. This creates an execution-scope ambiguity where an agent may run shell commands without an explicit least-privilege boundary, increasing the risk of unintended command execution or misuse of stored credentials like APP_KEY. In this case the documented behavior is simple API access, but the lack of declared scope still weakens enforcement and auditability.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example output is entirely in Chinese, which suggests the skill may present results in a fixed language. The README does not mention any user-selectable language option or justify a Chinese-only locale, which can conflict with language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script emits all user-facing status and table labels in Chinese, such as '系统共有', '统计信息', and column headers. This imposes a specific language/locale on all users without opt-in or documented justification, which matches the language-policy violation criterion.
- Content