T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/freelance.py:238- Finding
Path Traversal in Job File Lookup
- Content
View full analysis
- Remediation
View remediation
Security audit
Neckr0ik Freelance Automator
Security checks for vulnerabilities and agentic risk
Overview
This skill is presented as real freelance-platform automation, but the inspected code mostly creates local synthetic job records and drafts, which could mislead users running a freelance business.
Review this carefully before installing. Treat its job results as generated examples unless the publisher adds real platform integrations and clear labeling. Do not rely on it to send client messages, invoices, proposals, or platform actions without manual review. Avoid using sensitive client data with proposal generation unless you are comfortable sending it to a local Ollama model, and be aware it stores business records under ~/.freelance-automator.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation claims real automation across Upwork, Fiverr, Freelancer, and PeoplePerHour, including job finding, proposal handling, and delivery, but the implementation reportedly only fabricates example jobs and performs local generation/storage. This mismatch is dangerous because users may rely on false assumptions about external actions, leading to business decisions, accidental disclosure of data, or trust in outputs that were never validated against real platforms.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises operational CLI behaviors and references an implementation script with file and shell capabilities, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations can cause over-broad access assumptions and make it easier for the skill to read, write, or invoke commands beyond what a user expects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Promoting automated client responses and follow-up messaging without warning about review requirements or unintended outbound communication can cause the system to send inaccurate, inappropriate, or sensitive messages automatically. In a freelance-business context, that can damage client relationships, leak project details, or violate platform communication policies.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly describes sending invoices directly to client email without mentioning confirmation, recipient verification, or safeguards around external transmission. That creates a risk of accidental outbound delivery to the wrong party, unauthorized disclosure of billing information, or spam-like behavior initiated without adequate user review.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The tool claims to find freelance jobs but actually fabricates realistic-looking listings and persists them as if they were genuine search results. In an automation skill for running a freelance business, this is dangerous because it can mislead users into acting on false opportunities, producing fraudulent proposals, wasted effort, and potentially reputational or financial harm.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Proposal generation sends job and client-related content to an ollama subprocess without explicit user consent or a clear disclosure at the point of use. In this skill context, users may include client names, project details, budgets, or sensitive work descriptions, so silent transmission to another processing component creates a data-handling and confidentiality risk.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python Keep it under 300 words.""" try: result = subprocess.run( ["ollama", "run", "llama3.2:latest", prompt], capture_output=True, text=True,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The generated invoice text always includes
Crypto (USDC/USDT)alongside other payment methods. This imposes a specific payment/locale/business-policy choice in natural-language output rather than offering the user a choice or making it configurable.- Content
Static analysis
No suspicious patterns detected.