T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:1073- Finding
Unrestricted SIEM Endpoint Can Expose Sensitive Transaction Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Enterprise Agent Commerce Playbook: Fortune 500 Adoption Guide for Autonomous B2B Transactions
Security checks for vulnerabilities and agentic risk
Overview
This is a non-executable enterprise guide whose sensitive examples are aligned with its procurement-automation purpose, but users should treat the API, SIEM, credential, and real-money rollout examples as templates requiring security review before use.
Install is low risk as a guide, but do not operationalize its examples directly. Before using the SIEM, credential, marketplace, or real-money transaction patterns, have security, privacy, legal, procurement, and finance teams approve the design, add strict endpoint and data controls, use sandbox testing first, enforce spending caps and human approval gates, and document emergency shutdown procedures.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide asserts that it does not execute code, require credentials, or install dependencies, yet later includes concrete code that instantiates API clients, performs marketplace queries, posts data to endpoints, and demonstrates handling API keys. This mismatch can mislead users and downstream tooling into treating the skill as lower risk than it is, increasing the chance that example code is copied into live environments without appropriate review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The guide recommends forwarding rich transaction, identity, and decision-rationale data into a SIEM, but does not pair this with an explicit privacy and data-minimization warning in the skill description. Because this data can include sensitive business records and potentially personal data, users may over-collect or over-share telemetry in ways that create compliance and confidentiality risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The example code performs an external HTTP POST of assembled transaction and decision metadata to a SIEM endpoint. Although presented as illustrative logging, this creates a real exfiltration pattern if copied into production without validation, potentially sending sensitive financial, operational, or personal data to unintended destinations or insecure collectors.
- Content
} } # Push to SIEM via HTTP endpoint or syslog requests.post(siem_endpoint, json=siem_event)
text **Correlation rules.** Create SIEM correlation rules that detect anomalous agent behavior: spending spikes, unusual vendor patterns, transactions outside approved categories, failed authentication attempts, and escrow timeout patterns. These rules should trigger alerts that route to the agent commerce operations team.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The rollout guidance instructs users to begin production transactions with real money and real vendors, but it lacks a prominent explicit warning about financial loss, procurement abuse, contractual exposure, and operational disruption. In an enterprise procurement context, readers may operationalize these steps directly, making omission of risk warnings materially dangerous.
- Content