T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:49- Finding
Public API gateway example processes requests without sender authorization
- Content
View full analysis
- Remediation
View remediation
Security audit
Super Pilot Api Gateway
Security checks for vulnerabilities and agentic risk
Overview
The skill is a remote API gateway whose examples can publicly expose local services without clear access-control guidance.
Review before installing or using. This skill may be appropriate only if you already understand Pilot Protocol access controls and can restrict who reaches the gateway. Do not copy the --public example for real local APIs unless you add explicit authentication, authorization, request validation, logging, and least-privilege service boundaries.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow example starts the daemon with the '--public' flag while the description emphasizes access without public internet exposure. This directly undermines the stated security posture and could lead operators to expose a local API more broadly than expected, especially if copied verbatim.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation provides commands and a copy-pastable workflow that expose local APIs to remote agents but does not prominently warn that local service data may be transmitted off-host and made remotely accessible. In a gateway/exposure skill, missing warnings materially increase the chance of accidental data exposure or unsafe publication of internal endpoints.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata claims it is 'not for HTTP-only proxying,' but the documented commands explicitly start a gateway and map remote hostnames to local IPs. This inconsistency can mislead users about the actual exposure model and may cause them to publish internal services under weaker assumptions than intended.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file says the skill should be used 'when you need private API exposure or agent-service integration,' which is a broad natural-language condition rather than a narrowly scoped trigger. It does not provide explicit trigger phrases, exclusion conditions beyond a couple examples, or clear boundaries to prevent unintended invocation in adjacent API/integration contexts.
- Content