T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:40- Finding
Potential Shell Command Injection Through Unsanitized Search Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Social Listening
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent social-listening workflow, but its shell-style search examples can mishandle untrusted brand or topic text if an agent runs them naively.
Review before installing. This skill is not malicious, but it should be used only in an agent/runtime that passes search terms as inert arguments rather than interpolating user text into a shell command. Also check whether `.agents/product-marketing-context.md` or `.claude/product-marketing-context.md` contains sensitive internal plans before letting the skill use that context for social-search work.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description says to use the skill when the user wants 'social listening' as well as broader phrases like 'monitor brand' and 'track sentiment.' These phrases are common in general marketing discussions and the file does not provide exclusion conditions or negative examples to narrow when this skill should activate versus related analysis skills.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read a local workspace file before asking the user, without requiring disclosure or consent. That creates a covert workspace-data access path: even if the file is intended to be helpful project context, it may contain sensitive internal marketing plans, customer details, or other proprietary data that the user did not explicitly authorize the skill to inspect for this task.
- Content
Static analysis
No suspicious patterns detected.