T09 · Insecure Skill Coding Practices
Error
- Location
references/examples.md:694- Finding
Destructive database cleanup lacks environment safeguards
- Content
View full analysis
- Remediation
View remediation
Security audit
e2e-test-specialist
Security checks for vulnerabilities and agentic risk
Overview
This testing skill is mostly ordinary documentation, but it includes copyable examples that can wipe database tables without strong safety checks.
Review before installing or reusing. The skill is not deceptive and does not contain executable install logic, but copy its examples only into isolated test environments. Add a hard guard before any database reset, avoid production or shared credentials, keep Cypress browser security enabled unless narrowly justified, and pin CI actions, npx tools, and container images for controlled updates.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/examples.md:185- Finding
Cypress example globally disables browser web security
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/examples.md:768- Finding
CI workflow examples use mutable third-party action and container references
- Content
View full analysis
- Remediation
View remediation
`. 3. Preserve a version comment next to each SHA so maintainers can identify the intended release. 4. Use Dependabot or Renovate to propose controlled updates that receive code review. 5. Configure minimal explicit workflow permissions, such as: ```yaml permissions: contents: read ``` 6. Grant write permissions only to the specific jobs that require them. 7. Avoid exposing secrets to pull-request workflows that execute untrusted code. 8. Use environment protection rules and short-lived credentials for sensitive resources. 9. Isolate CI runners, restrict egress, and prefer ephemeral runners. 10. Verify container provenance and signatures where supported. 11. Add dependency and workflow-policy scanning to reject unpinned action or image references. Example pinning pattern: ```yaml - uses: actions/checkout@ # intended release - uses: actions/setup-node@ # intended release - uses: actions/upload-artifact@ # intended release ``` ```yaml docker run -d \ --name test-db \ -e POSTGRES_DB=test_db \ -e POSTGRES_USER=test_user \ -e POSTGRES_PASSWORD=test_password \ -p 5432:5432 \ postgres:13@sha256: ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The examples include unconditional destructive operations such as 'TRUNCATE TABLE users, products, orders CASCADE' with default localhost/test credentials and no prominent warning that the code will wipe database contents. In a testing skill, this is plausible and likely benign in intent, but it is still dangerous because users may copy it into misconfigured environments or point it at a non-isolated database, causing irreversible data loss.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file contains code examples that write screenshots to disk and later upload or retain generated artifacts, but the surrounding documentation provides no warning that running these examples will create files and preserve test outputs. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that can affect user data or system state.
- Content
Static analysis
No suspicious patterns detected.