T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:114- Finding
Submission, OAuth, and File-Upload Operations Exceed the Skill's Declared Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
Add Directories
Security checks for vulnerabilities and agentic risk
Overview
The skill claims submission is out of scope but then instructs agents to submit forms, upload files, use OAuth, store credentials, and create GitHub pull requests.
Review this carefully before installing. The local parsing and classification pieces are coherent, but the submission sections should be removed or split into a separate explicitly authorized skill. Do not run bulk submission, use OAuth sessions, upload files, create GitHub PRs, or store real passwords in project JSON without per-site review and explicit approval.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:196- Finding
Plaintext Credential Fields May Be Stored and Sent to Untrusted Submission Targets
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest explicitly says submission is out of scope, but the rest of the document instructs submission via automation, manual browser interaction, and GitHub PRs. This inconsistency is dangerous because policy or routing systems may trust the manifest while the body quietly grants more powerful behaviors.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill’s body expands from updating a local JSON file into discovering forms and submitting data to third-party sites, directly contradicting the manifest’s stated scope. This is dangerous because an agent selecting the skill for a low-risk data maintenance task could be induced into making external side effects, including submissions, browser interactions, and account-related actions the user did not explicitly authorize.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The automated/manual submission section authorizes actions such as filling forms, uploading files, handling OAuth flows, and clicking submit, which are unrelated to the declared task of adding entries to directories.json. That mismatch creates a capability-escalation risk where a seemingly administrative skill can perform real-world external actions on third-party services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Authorizing use of the gh CLI to clone repositories and potentially operate on curated lists is broader than necessary for simple parsing of provided inputs. While cloning public repos is not inherently dangerous, adding repository-manipulation guidance in a data-ingestion skill increases the chance of unnecessary credential use and scope creep.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs making external changes—submissions, uploads, and button clicks on third-party sites—without an upfront warning that these actions have side effects outside the local repository. In agentic settings, lack of explicit user warning and confirmation can lead to unintended postings, account use, or data disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Including GitHub fork/clone/branch/push/PR instructions extends the skill from local data curation into modifying external repositories. Even if framed as optional, this broadens the agent’s authority and can cause unintended public changes under the operator’s credentials.
- Content
Static analysis
No suspicious patterns detected.