T09 · Insecure Skill Coding Practices
Error
- Location
scripts/captcha.py:67- Finding
Server-Side Request Forgery Through User-Controlled Image URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
captcha-recognition
Security checks for vulnerabilities and agentic risk
Overview
This CAPTCHA/OCR tool is transparent about its purpose, but it needs review because it can download arbitrary user-provided URLs from the agent's network and installs unpinned Python packages.
Install only if you are comfortable with the skill making HTTP/HTTPS requests to image URLs you provide. Avoid using it on localhost, private-network, cloud metadata, or untrusted redirected URLs, and run it in a restricted environment with pinned dependencies if possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:36- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill explicitly supports fetching CAPTCHA images from HTTP/HTTPS URLs, which introduces network access behavior, but it declares no permissions or allowed-tools scope. This creates an authorization and transparency gap: an agent may invoke external requests without clear scoping, increasing the risk of unintended outbound access, SSRF-like behavior against internal URLs, or policy bypass in constrained environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The description expands the skill from CAPTCHA recognition into generic OCR, blurring its operational boundary. When a skill with URL-fetching capability is described as broadly applicable OCR, it is more likely to be selected for unrelated tasks, increasing the chance of overreach, unexpected data handling, and misuse beyond the intended CAPTCHA scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "OCR" is far broader than CAPTCHA recognition and can cause this skill to activate for general text extraction tasks unrelated to CAPTCHAs. Over-broad invocation expands the situations in which the skill may process arbitrary user-supplied images or URLs, increasing exposure to unnecessary network access and unintended handling of sensitive documents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The usage examples include generic OCR requests like extracting text from images, which train or encourage invocation outside the stated CAPTCHA-specific purpose. This broadening matters because the skill also supports network URLs, so unrelated OCR requests could trigger remote fetching or processing of arbitrary images and increase privacy, policy, and abuse risks.
- Content