T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:11- Finding
Mandatory Access to External Credential-Bearing Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Selection Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is for SEO and competitor research, but it asks the agent to read broad local secrets and run unaudited external code before doing the work.
Review before installing. Only use this skill in a controlled environment where /tmp/powerful-trendplus is trusted, immutable, and owned by you; replace broad token loading with least-privilege credentials; and require explicit confirmation before any run that reads secrets, writes to Sheets, accesses internal databases, or calls third-party APIs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:15- Finding
Sourcing an External Environment File Before Executing an Unaudited Script
- Content
View full analysis
/dev/null python3 scripts/run_full_research.py ``` ``` ### Technical Analysis The Skill changes into an external directory, sources `.env.local` in the active shell, and executes `scripts/run_full_research.py`. Neither file is part of the reviewed artifact. The shell `source` command does not merely parse static key-value data. It executes the entire referenced file as shell code with the permissions of the current process. Therefore, if `/tmp/powerful-trendplus/.env.local` is writable by another user, replaced, or compromised, arbitrary shell commands can execute immediately. The Python script is also outside the audited package and can change independently after review. It may access files, credentials, environment variables, and network resources available to the invoking process. The redirection `2>/dev/null` suppresses diagnostic output from the sourcing step, reducing visibility into missing files, syntax failures, or malicious commands that intentionally report errors. Sourced variables are inherited by the Python child process when they are exported by `.env.local`, already exported in the parent environment, or exported through shell settings. In addition, the sourced file itself can directly execute commands or alter shell state. ### Attack Path 1. A user invokes the Skill through a configured trigger phrase. 2. The agent changes its working directory to `/tmp/powerful-trendplus`. 3. An attacker who can modify `.env.local` places arbitrary shell commands in that file. 4. The `source .env.local` command executes those commands with the agent process's permissions. 5. Alternatively, an attacker modifies `scripts/run_full_research.py`. 6. The Skill executes the modif ...[truncated 1318 chars]- Remediation
View remediation
/dev/null` with explicit error handling and security-relevant logging that does not expose secret values. 9. Run the research process in a sandbox with restricted filesystem access, network destinations, and operating-system privileges. 10. Use narrowly scoped, read-only, and short-lived credentials, and prevent child processes from inheriting unrelated secrets. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The command explicitly sources
.env.local, causing the runtime to ingest all secrets from a local environment file before running the research script. This is a classic credential-access pattern that can expose or misuse secrets if the skill is triggered unexpectedly, if the script behavior changes, or if downstream tools log or transmit loaded values.- Content
快速执行
bash cd /tmp/powerful-trendplus source .env.local 2>/dev/null python3 scripts/run_full_research.py
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad and generic, so the skill could activate on ordinary conversation about products, SEO, or competitors without clear intent to run it. In an agent system that can load secrets and external integrations, overbroad activation materially raises the risk of unintended execution and data access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The skill metadata and instructions are written entirely in Chinese while also including English trigger phrases, but there is no statement that the user can choose the interaction language. This can amount to a language policy issue because the skill appears to impose a specific language without opt-in or documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly discloses where tokens are stored and instructs automatic loading from local files and shell configuration, which normalizes credential access as part of routine execution. In an adversarial or mis-triggered context, that makes secret discovery and use significantly easier and increases the blast radius beyond the stated task.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs access to multiple credentials and integrations that exceed the narrowly described research function, including OAuth- and database-backed systems. Even if intended for convenience, expanding the data/control surface in a documentation-driven agent increases the chance of unnecessary secret exposure and unauthorized access during execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Declaring Google Sheets output and MySQL internal data comparison broadens the skill from analysis into data egress and internal data access. That creates unnecessary pathways for sensitive business data to be read or exported without clear scope boundaries in the manifest.
- Content
Static analysis
No suspicious patterns detected.