T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generator.py:137- Finding
Unrestricted Output Path Allows Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Neckr0ik Code Generator
Security checks for vulnerabilities and agentic risk
Overview
This code-generator skill is not malicious, but it can write and overwrite local project files with weak path and input controls, so it should be reviewed before use.
Use this only in a disposable or clearly chosen output directory, review generated files before running them, and avoid untrusted model names, field names, project names, or output paths. Do not rely on its advertised API-client or multi-language features without verifying the actual implementation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generator.py:20- Finding
Unsanitized Identifiers Permit Python Source Injection into Generated Code
- Content
View full analysis
{model_name}: """Create a new {model_lower}.""" db_{model_lower} = {model_name}({create_fields}) db.add(db_{model_lower}) db.commit() db.refresh(db_{model_lower}) return db_{model_lower} def get(self, db: Session, {model_lower}_id: int) -> Optional[{model_name}]: """Get a {model_lower} by ID.""" return db.query({model_name}).filter({model_name}.id == {model_lower}_id).first() ``` The model generator applies the same pattern to field and model names: ```python def python_model_template(model_name, fields): """Generate SQLAlchemy model.""" field_defs = "\n ".join([f"{k} = Column(String(255))" for k in fields.keys()]) return f'''""" {model_name} model. Auto-generated by neckr0ik-code-generator. """ from sqlalchemy import Column, Integer, String, DateTime from sqlalchemy.ext.declarative import declarative_base from datetime import datetime Base = declarative_base() class {model_name}(Base): """{model_name} database model.""" __tablename__ = "{model_name.lower()}s" id = Column(Integer, primary_key=True, index=True) {field_ ...[truncated 2578 chars]- Remediation
View remediation
str: if not value or not value.isidentifier() or keyword.iskeyword(value): raise ValueError(f"Invalid Python identifier for {label}: {value!r}") return value ``` 2. Apply validation to the model name and every field name before template generation: ```python model_name = validate_identifier(model_name, "model") for field_name in fields: validate_identifier(field_name, "field") ``` 3. Reject control characters, line breaks, quotes, path separators, and unexpected punctuation at the CLI boundary. 4. Define an allowlist for field types rather than accepting unrestricted type text, even though the current SQLAlchemy template does not use the parsed type value. 5. Prefer constructing generated Python through the standard `ast` module or another structured code-generation mechanism instead of directly interpolating untrusted text. 6. Parse generated code with `ast.parse()` before returning it. This verifies syntax, although it must supplement rather than replace identifier validation. 7. Add negative tests for Python keywords, newline injection, quote injection, semicolons, decorators, comments, Unicode edge cases, and malformed field definitions. 8. Clearly document that generated code must be reviewed before execution, particularly when arguments originate from an untrusted specification or automated workflow. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises code-generation behavior that inherently writes files and may invoke shell-like operations, but it declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may execute filesystem or command actions without the user being clearly informed of the required capabilities or constrained to a narrow set of tools.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md neckr0ik-code-generator crud User --fields "name,email,created_at" # Generate an API client neckr0ik-code-generator api-client --spec https://api.example.com/openapi.json # Generate tests neckr0ik-code-generator tests --source ./src --type unit
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description is broadly scoped and can trigger on vague requests to 'generate code' or 'scaffold' without limiting technologies, trust boundaries, or safe-use conditions. In an agent ecosystem, this can cause overbroad invocation and lead the skill to produce high-risk boilerplate such as insecure CRUD endpoints, API clients, or database code in contexts where stronger review or narrower tooling should apply.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says the skill generates scaffolds, CRUD, models, tests, and config, but it does not clearly warn that these actions will create directories and write multiple files to disk. This can surprise users and lead to unintended repository modifications, overwrites, or generation in the wrong location.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The api-client command accepts a URL for --spec, but the description does not warn users that the skill may perform outbound network access to fetch remote OpenAPI documents. Unannounced remote fetching can expose metadata, trigger requests to attacker-controlled endpoints, or introduce untrusted input into downstream code generation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code creates directories and writes several files into the target output path, which is a safety-relevant filesystem modification. While it prints success messages afterward, there is no prior confirmation prompt and the docstrings/comments do not explicitly warn that running the scaffold command will create or overwrite project files in the specified location.
- Content
Static analysis
No suspicious patterns detected.