T08 · Insecure Dependencies
Warning
- Location
SKILL.md:43- Finding
Unpinned External CLI Dependency Creates a Supply-Chain Trust Gap
- Content
View full analysis
- Remediation
View remediation
Security audit
shodan-skill
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Shodan integration, but it needs Review because it uses an unpinned external CLI and defaults to running credit-consuming, mutating, scanning, and destructive operations without confirmation.
Install only if you trust the exact external shodan-skill package you install and are comfortable with an agent executing explicit Shodan requests immediately. For scans, deletions, organization changes, credit-consuming searches, and overwrites, prefer strict mode or dry-run unless you have already reviewed the exact target, account impact, and cost.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:20- Finding
High-Impact Shodan Operations Execute Without Confirmation by Default
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Repository live tests remain fail-closed and independent from normal direct-mode CLI execution. Validate every dynamic URL path segment before constructing a transport so an identifier cannot alter the requested endpoint. Redact API keys, authorization headers, bearer tokens, cookies, provider arguments (including routing keys and webhook URLs), signed URLs, and credential-like values from all outputs and errors. The HTTP transport ignores ambient `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, and `.netrc` settings. Use only an explicitly reviewed `SHODAN_PROXY` or root-level `--proxy` value; a proxy can observe Shodan query authentication. Prefer the environment variable when the proxy URL contains credentials, and keep every timeout finite. Do not automatically retry credit-consuming GET requests. A user may retry explicitly after reviewing the failure; no-credit GET requests may use the bounded transport retry policy.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The snapshot enumerates numerous state-changing and potentially destructive operations, including scan initiation, alert management, notifier management, and organization membership changes, without any embedded constraints, approval gates, or trigger scoping. In this skill’s context, the metadata explicitly says to treat the user’s request as authorization to execute without second confirmation, which increases the chance of unsafe or over-broad actions being performed from loosely scoped prompts.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The file explicitly documents that state-changing operations run in a default
directmode that continues without confirmation or an authorization acknowledgement. In a skill that can create scans, alerts, and notifiers or delete and modify them, this enables autonomous execution of impactful external actions from a user's prompt, increasing the risk of unintended scans, monitoring changes, destructive deletions, and credit consumption.- Content
shodan-skill notifier delete <NOTIFIER_ID>
text Every mutation emits a deterministic JSON preview before sending HTTP. The preview includes the operation, identifiers, target count when calculable, credit impact, and reversibility. Default `direct` mode continues without confirmation or an authorization acknowledgement. Use `--dry-run` to stop after preview, or select `strict` mode to restore the compatibility gates. On-demand scans can consume scan credits. Internet-wide scans require Enterprise access. Validate every target, custom service, alert/notifier ID, trigger, and ignored `IP:PORT` service before creating a transport. Reject separators and traversal segments in every dynamic URL path segment so the requested operation cannot be rewritten.
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md Trends.search(query, facets) Trends.search_filters() Trends.search_facets() Stream.banners(raw=False, timeout=None) Stream.asn(asn, raw=False, timeout=None) Stream.countries(countries, raw=False, timeout=None) Stream.ports(ports, raw=False, timeout=None)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file states that exploit code is preserved by default and only mentions optional flags to omit or truncate it. Because displaying or handling exploit code can affect user safety and downstream use, the description should include an explicit warning so users understand the sensitivity of the content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 47% confidence
- Finding
The manifest references English-language developer documentation URLs only, and there is no indication that language selection is configurable or user-chosen. If this snapshot is used to govern skill behavior or documentation lookup, it may implicitly force a single language/locale without user opt-in.
- Content