Security audit

team-collaboration

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches a team-collaboration tool, but it exposes high-impact delete and access-control actions with weak safety guidance and published reusable credentials.

Install only for a trusted local backend and do not treat the documented admin password or API key as safe defaults. Require explicit user confirmation before deletes or role changes, rotate/remove any matching credentials, and avoid exposing the localhost service or WebSocket endpoint through tunnels or shared networks unless TLS and authentication are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:709
Finding: Hardcoded Administrative Credentials and Reusable API Key in Skill Documentation
Content: View full analysis
Remediation: View remediation
", password: "" ``` 4. Generate a unique, cryptographically random API key for each installation and principal. 5. Store credentials in an approved secret manager or protected runtime environment, not in Skill files. 6. Require first-run administrator provisioning rather than shipping a default administrator password. 7. Apply expiration, rotation, revocation, and least-privilege scopes to API keys. 8. Add automated secret scanning to source-control and release pipelines. 9. Audit authentication logs for prior use of the exposed values. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:3
Finding: Passwords and Bearer Tokens Transmitted Over Unencrypted HTTP
Content: View full analysis
{ const options = { hostname: 'localhost', port: 8080, path: path, method: method, headers: { 'Content-Type': 'application/json' } }; const useToken = customToken || token; if (useToken) { options.headers['Authorization'] = 'Bearer ' + useToken; } const req = http.request(options, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { resolve(JSON.parse(data)); } catch { resolve(data); } }); }); req.on('error', reject); if (body) { req.write(JSON.stringify(body)); } req.end(); }); } ``` ```javascript const auth_register = async function(args) { return request('/api/auth/register', 'POST', args); }; const auth_login = async function(args) { const result = await request('/api/auth/login', 'POST', args); if (result.success && result.data && result.data.token) { token = result.data.token; } return result; }; ``` Related documentation also specifies plaintext endpoints: ```text Backend: http://localhost:8080 Real-time notifications: ws://localhost:8080/ws/notification ``` ### Technical Analysis The client uses Node.js `http` rather than `https`. Registration and login arguments are serialized into request bodies, causing passwords to be sent without transport encryption. After login, the bearer token is stored in process memory and attached to subsequent plaintext requests in the `Authorization` header. The network behavior itself ...[truncated 2261 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description is written entirely in Chinese and the rest of the skill documentation and examples are likewise Chinese-only, with no indication that users may choose another language or locale. This is a natural-language locale constraint that is not documented as region-specific or opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a team collaboration system for managing projects, requirements, tasks, bugs, documents, and milestones. However, the documented actions also include broad account registration, authentication, and RBAC administration such as creating roles and assigning permission sets, which extend beyond the core collaboration-management scope described in the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents destructive operations such as deleting projects, requirements, tasks, bugs, documents, milestones, and roles without any confirmation, authorization, or safety guidance for agents. In an agent setting, this increases the chance of accidental or prompt-induced destructive actions that can cause irreversible data loss or administrative disruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The authentication and notification guidance omits key security warnings around bearer tokens, API keys, and unauthenticated or plaintext WebSocket usage (ws://). This can lead implementers to expose credentials in insecure channels, logs, or client code, and the WebSocket endpoint may permit interception or spoofed notifications if used beyond localhost or without transport/authentication controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation embeds or normalizes a static agent API key (agent-api-key-12345) for authentication. Static shared credentials are highly risky because they are easily copied, reused across agents, and often end up hardcoded in prompts, logs, or repositories, enabling unauthorized access to all exposed management functions including destructive ones.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The shared request helper sends JSON request bodies and optionally an Authorization bearer token over HTTP, but the file provides no confirmation prompt, logging, print statement, or explanatory comment warning that user data and credentials will be transmitted. Because many exported functions rely on this helper for login and CRUD operations, the network transmission is silent from the user's perspective.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a team collaboration system centered on projects, requirements, tasks, bugs, documents, and milestones. In addition to those collaboration features, the code exposes user listing plus full role-management and permission-listing operations, which are administrative access-control capabilities not conveyed by the stated description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes deletion functions such as delete_project that issue DELETE requests directly, with no confirmation prompt, warning comment, or user-facing notice. The same pattern is repeated for requirements, tasks, bugs, documents, milestones, and roles, making irreversible actions easy to trigger silently.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Creating, updating, and deleting roles and enumerating permissions are security-administration capabilities, not an obvious requirement for a skill described only as project/requirement/task/bug/document/milestone management. These operations materially expand the skill from collaboration workflows into authorization management.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest advertises a team collaboration system focused on projects, requirements, tasks, bugs, documents, and milestones, but it also exposes authentication and user registration capabilities. This mismatch can mislead users and downstream policy systems about the skill’s real privilege surface, increasing the chance that credentials are solicited or accounts are created without informed consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest omits that the skill includes role and permission administration, which materially expands its authority from collaboration into access-control management. Hidden administrative capabilities are dangerous because users or agents may invoke privileged operations without understanding they can create, modify, or delete authorization roles.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The authentication tools collect usernames and passwords but provide no disclosure about how credentials are handled, transmitted, stored, or redacted. This creates a risk of unsafe credential collection, logging, or use through an agent interface where users may not realize the sensitivity of the data they are providing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill exposes delete operations directly in the manifest without any indication of confirmation requirements, soft-delete behavior, or scope constraints. In a project management context, accidental or unauthorized invocation could permanently remove business-critical records such as projects, tasks, bugs, documents, or roles.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: Multiple comments and module labels are written only in Chinese, and the file does not indicate that language choice is optional or context-specific. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue when no justification or alternative is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The only natural-language description in the skill metadata is presented in Chinese, with no indication that other languages are supported or that the skill is region-specific. This can violate language/locale policy when a skill implicitly fixes the interaction language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.