T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:12- Finding
Reusable Session Tokens Persisted in Plaintext
- Content
View full analysis
" REFRESH_TOKEN="" cat > "$IPA_COOKIE_FILE" <- Remediation
View remediation
Security audit
I'm Pretty Amazing
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent service integration, but it asks agents to store reusable account session tokens in plaintext and handle them in ways that could expose the account.
Review this before installing if the account matters to you. Avoid opting into saved session tokens unless TOOLS.md is protected from other users, extensions, backups, and future agent sessions; prefer session-only login or a proper credential store, and clear/revoke saved tokens if exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:85- Finding
Passwords and Session Tokens Exposed Through Command-Line Arguments
- Content
View full analysis
; refresh_token=" ``` ### Technical Analysis Arguments supplied with `-d` and `-H` become part of the `curl` process command line. Depending on the operating system and execution environment, command arguments may be observable through: - Process inspection facilities such as `/proc` or process-listing utilities. - Shell history if commands are entered interactively. - Agent tool-call records and execution telemetry. - Debug traces, audit logs, or error reports. - Command wrappers that record complete invocations. The login example exposes both the email address and password. The explicit `Cookie` header example exposes reusable access and refresh tokens. HTTPS protects the network transport but does not prevent local disclosure before the request is transmitted. ### Attack Path 1. The agent substitutes the user's actual email, password, or session tokens into the documented command. 2. The command is executed with those values present in its argument vector. 3. A local observer, command wrapper, telemetry collector, or log reader captures the command arguments. 4. The attacker extracts the password or bearer tokens. 5. The attacker logs in with the password or replays the captured cookies against the service API. 6. T ...[truncated 655 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:66- Finding
Predictable and Insufficiently Protected Temporary Cookie Files
- Content
View full analysis
" REFRESH_TOKEN="" cat > "$IPA_COOKIE_FILE" <` rather than an atomic secure-file creation primitive. In a shared temporary directory, a local attacker may be able to anticipate the path and pre-position a file or symbolic link before the Skill writes the credentials. The documentation does not set `umask 077` or enforce mode `0600`. Resulting permissions therefore depend on the ambient process configuration and the behavior of the tools creating or replacing the cookie jar. Cleanup occurs only when the user explicitly asks to log out or clear the session. There is no `EXIT`, signal, or failure trap, so cookie files can survive completed, interrupted, or failed operations. The wild ...[truncated 1713 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (24)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs persistence of access and refresh token cookie values in TOOLS.md, a plaintext file. Session tokens function as bearer credentials, so anyone with access to that file could replay them to impersonate the user and access or modify their account.
- Content
markdown ### I'm Pretty Amazing - **Username:** their-username (optional) - **Access Token Cookie:** eyJhbGciOi... - **Refresh Token Cookie:** eyJhbGciOi... (optional but recommended) - **Access Token Expires At (UTC):** 2026-03-21T03:04:46Z
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The token-handling section normalizes storing access tokens in TOOLS.md while merely warning not to print them. The core issue is not display but retention of reusable authentication material in plaintext, which materially increases account takeover risk.
- Content
- Username: their-username (optional)
- Access Token Cookie: eyJhbGciOi...
- Refresh Token Cookie: eyJhbGciOi... (optional but recommended)
- Access Token Expires At (UTC): 2026-03-21T03:04:46Z
text Token handling:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The authentication flow directs the agent to read persisted access and refresh tokens from TOOLS.md for reuse. This creates a standing credential cache in a non-secret document, making theft or accidental disclosure of valid session material much more likely.
- Content
md For cookie-auth endpoints, follow these steps: **Step 0 — Reuse persisted auth if still valid (preferred):** 1. Read persisted `Access Token Cookie` (and `Refresh Token Cookie` if available) from TOOLS.md. 2. Verify that `Access Token Cookie` is present and `Access Token Expires At (UTC)` is a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SSZ). If either is missing or malformed, continue to Step 1. 3. If `Access Token Expires At (UTC)` is in the future, rebuild a cookie jar from those values and use that jar for requests. 4. If expired, continue to Step 1.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line continues the reuse model for plaintext-stored access tokens based on expiry metadata, effectively encouraging long-lived secret retention. Reusing stored session cookies without a secure vault increases the blast radius of any disclosure of TOOLS.md.
- Content
md **Step 0 — Reuse persisted auth if still valid (preferred):** 1. Read persisted `Access Token Cookie` (and `Refresh Token Cookie` if available) from TOOLS.md. 2. Verify that `Access Token Cookie` is present and `Access Token Expires At (UTC)` is a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SSZ). If either is missing or malformed, continue to Step 1. 3. If `Access Token Expires At (UTC)` is in the future, rebuild a cookie jar from those values and use that jar for requests. 4. If expired, continue to Step 1.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The guidance to rebuild a cookie jar from token values in TOOLS.md demonstrates direct operational reuse of exposed bearer secrets. This makes the plaintext file a complete source for authenticated session reconstruction and account impersonation.
- Content
md **Step 0 — Reuse persisted auth if still valid (preferred):** 1. Read persisted `Access Token Cookie` (and `Refresh Token Cookie` if available) from TOOLS.md. 2. Verify that `Access Token Cookie` is present and `Access Token Expires At (UTC)` is a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SSZ). If either is missing or malformed, continue to Step 1. 3. If `Access Token Expires At (UTC)` is in the future, rebuild a cookie jar from those values and use that jar for requests. 4. If expired, continue to Step 1. Canonical cookie-jar rebuild snippet (substitute persisted values from TOOLS.md):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The snippet assigns access and refresh tokens from TOOLS.md into shell variables, further exposing secrets to process environments and shell history depending on execution context. Combined with plaintext storage, this materially increases credential leakage opportunities.
- Content
bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" ACCESS_TOKEN="<Access Token Cookie from TOOLS.md>" REFRESH_TOKEN="<Refresh Token Cookie from TOOLS.md>" cat > "$IPA_COOKIE_FILE" <<EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This instruction explicitly tells the agent to persist token expiry metadata alongside access and refresh tokens in TOOLS.md. Expiry metadata makes the cached credentials easier to operationalize by signaling when stolen tokens remain valid.
- Content
echo "$ACCESS_TOKEN_EXPIRES_AT_UTC"
text Persist `ACCESS_TOKEN_EXPIRES_AT_UTC` as `Access Token Expires At (UTC)` in TOOLS.md. Persist `ACCESS_TOKEN` as `Access Token Cookie` and `REFRESH_TOKEN` (if present) as `Refresh Token Cookie`. **Step 2 — Make API calls (reuse the cookie file):**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
Persisting both ACCESS_TOKEN and REFRESH_TOKEN in plaintext is especially dangerous because the refresh token can often mint new access tokens after expiry. That turns a local disclosure into potentially prolonged unauthorized access.
- Content
text Persist `ACCESS_TOKEN_EXPIRES_AT_UTC` as `Access Token Expires At (UTC)` in TOOLS.md. Persist `ACCESS_TOKEN` as `Access Token Cookie` and `REFRESH_TOKEN` (if present) as `Refresh Token Cookie`. **Step 2 — Make API calls (reuse the cookie file):** ```bash
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Embedding access and refresh tokens directly in a Cookie header exposes them in command text, which may be captured by logs, telemetry, shell history, debugging tools, or process listings. Because these are bearer-equivalent credentials, disclosure enables session hijacking.
- Content
bash curl -s https://api.imprettyamazing.com/wins/my-wins \ -H "Cookie: access_token=<Access Token Cookie from TOOLS.md>; refresh_token=<Refresh Token Cookie from TOOLS.md>"Step 3 — Handle expired sessions:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The session-refresh logic again instructs updating plaintext-stored access and refresh tokens in TOOLS.md after re-login. This entrenches insecure credential persistence and ensures sensitive tokens remain continuously available for theft.
- Content
md If any call returns `{"statusCode": 401, ...}`: 1. Prompt again for email/password (session-only). 2. Call `POST /auth/login` again and overwrite the cookie file with `-c`. 3. Re-extract cookies from `IPA_COOKIE_FILE`. If session persistence was previously opted in, update `access_token`, `refresh_token`, and `Access Token Expires At (UTC)` in TOOLS.md. 4. Retry the failed call. **Rules:**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md All cookie-auth actions require `-b "$IPA_COOKIE_FILE"` after login. **The API reference at [references/api.md](references/api.md) is the complete endpoint documentation. Read it before using any endpoint not shown above.** - **Update/delete wins**: `PATCH /wins/:id` (JSON body), `DELETE /wins/:id` - **Comments**: `POST /wins/:id/comments` with `{"content": "..."}`, `GET /wins/:id/comments` - **Likes**: `POST /wins/:id/like`, `DELETE /wins/:id/like` (toggle) - **Follow/unfollow**: `POST /follows/:userId`, `DELETE /follows/:userId`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Update/delete wins**: `PATCH /wins/:id` (JSON body), `DELETE /wins/:id` - **Comments**: `POST /wins/:id/comments` with `{"content": "..."}`, `GET /wins/:id/comments` - **Likes**: `POST /wins/:id/like`, `DELETE /wins/:id/like` (toggle) - **Follow/unfollow**: `POST /follows/:userId`, `DELETE /follows/:userId` - **Profile**: `PATCH /profile` (JSON: `username`, `bio` max 500 chars, `location`, `website`) - **Avatar/cover**: `POST /profile/avatar` (multipart `avatar`), `POST /profile/cover` (multipart `cover`, keep file small)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Update/delete wins**: `PATCH /wins/:id` (JSON body), `DELETE /wins/:id` - **Comments**: `POST /wins/:id/comments` with `{"content": "..."}`, `GET /wins/:id/comments` - **Likes**: `POST /wins/:id/like`, `DELETE /wins/:id/like` (toggle) - **Follow/unfollow**: `POST /follows/:userId`, `DELETE /follows/:userId` - **Profile**: `PATCH /profile` (JSON: `username`, `bio` max 500 chars, `location`, `website`) - **Avatar/cover**: `POST /profile/avatar` (multipart `avatar`), `POST /profile/cover` (multipart `cover`, keep file small) - **Feedback**: `POST /feedback` with `{"category": "BUG|FEATURE_REQUEST|GENERAL", "message": "...", "pageUrl": "...", "pageContext": "..."}`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The document advises persisting
access_tokenand optionallyrefresh_token, parsing JWT expiry, and reusing them for authentication. These tokens are bearer-equivalent session credentials; if an agent stores or handles them insecurely, anyone who obtains them can impersonate the user until expiry or refresh, making this especially dangerous in a skill that automates posting, profile changes, follows, and other authenticated actions.- Content
md Client guidance: you may persist cookie token values (`access_token`, optionally `refresh_token`) and reuse them until access-token expiry, then re-login. Canonical expiry tracking: derive `Access Token Expires At (UTC)` from the `access_token` JWT `exp` claim and refresh auth when expired. | Method | Endpoint | Description | |--------|----------|-------------|
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description includes proactive and broad triggers like posting wins, tracking achievements, and suggesting a win after something notable, which could match many ordinary conversations and cause the skill to activate unexpectedly. Because the skill can then solicit credentials and interact with an external service, accidental invocation increases privacy and consent risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 2 — Make API calls (reuse the cookie file):
bash curl -s https://api.imprettyamazing.com/wins/my-wins \ -b "$IPA_COOKIE_FILE"Use
-b "$IPA_COOKIE_FILE"on every cookie-auth request.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This example instructs the agent to construct a raw Cookie header directly from access and refresh token values stored in TOOLS.md. That increases exposure of bearer-equivalent session secrets by placing them into command lines and prompt-accessible plaintext storage, where they may be leaked through logs, process inspection, or unintended file access.
- Content
If only persisted cookie values are available (no cookie file yet), you can call with an explicit cookie header (substitute values from TOOLS.md):
bash curl -s https://api.imprettyamazing.com/wins/my-wins \ -H "Cookie: access_token=<Access Token Cookie from TOOLS.md>; refresh_token=<Refresh Token Cookie from TOOLS.md>"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The API guidance explicitly tells clients they may persist
access_tokenandrefresh_tokencookie values and reuse them, but it does not warn that these are sensitive session credentials that should be handled like secrets. In an agent/skill context, this can encourage long-lived storage of session tokens in logs, memory, or local state, increasing the chance of account takeover if those values are exposed.- Content
Static analysis
No suspicious patterns detected.