T09 · Insecure Skill Coding Practices
Error
- Location
scripts/crawl.py:45- Finding
Unrestricted User-Controlled URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Samvida
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly transparent about generating and deploying llms.txt files, but it needs review because it crawls arbitrary URLs and can use pasted deployment tokens to change live website hosting.
Install only if you are comfortable with an agent crawling the target site from its own network environment and using deployment-capable credentials. Use it only for sites you own or are authorized to manage, prefer short-lived least-privilege Cloudflare/Webflow tokens, revoke tokens after use, review the generated /tmp/samvida_llms.txt before deployment, and avoid running the crawler from a network that can reach sensitive internal services.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:240- Finding
Deployment API Tokens Are Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is marketed as a content-generation tool but also performs deployment, live-site modification, CMS detection, and publication actions. This is a dangerous capability expansion because users may consent to generation while unknowingly enabling infrastructure-changing actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is marketed as a content-generation tool but also performs deployment, live-site modification, CMS detection, and publication actions. This is a dangerous capability expansion because users may consent to generation while unknowingly enabling infrastructure-changing actions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow goes beyond document generation and includes replacing or deploying llms.txt on production websites. Hidden modification of live content is high risk because it can overwrite existing files, alter routing, and create externally visible changes under the guise of a low-risk authoring task.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill requests infrastructure credentials for Cloudflare and Webflow even though the stated purpose is merely generating llms.txt content. Collecting privileged tokens in chat expands the trust boundary dramatically and creates a direct path to account or site compromise if mishandled.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly solicits deployment secrets in conversation for later command-line use. This creates a classic secret-handling vulnerability because the chat channel is not an appropriate boundary for privileged infrastructure credentials and may expose them through logs, transcripts, or prompt leakage.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Requesting a Webflow API token directly through conversation enables privileged publication and redirect changes from a low-assurance interface. If intercepted, retained, or misused, the token could allow unauthorized modifications to the user's website.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
These functions can upload Workers code, add or update Cloudflare routes, create Webflow redirects, upload assets, and publish sites. That is a real high-risk capability because compromised prompting, misuse, or accidental invocation could alter third-party infrastructure and public website behavior well beyond simple file generation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README promotes website crawling, extraction of team/contact details, and one-command Cloudflare deployment without clearly warning about privacy implications, authorization expectations, or the risk of modifying a live site. In practice, users may run the skill against sites they do not control or deploy changes without understanding operational consequences, creating data-handling and integrity risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrases are broad and include natural-language requests like 'make my site agent-readable', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In a skill that performs crawling and can progress toward deployment actions, ambiguous invocation increases the risk of unintended data collection, confusing user consent boundaries, and accidental initiation of a sensitive workflow.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill invokes both shell commands and network-capable scripts but declares no tool scope or permissions boundary. Without explicit restriction, an agent/runtime may grant broader access than users expect, increasing the chance of unintended command execution or external access during use.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: samvida description: Generate an agentic contract (llms.txt) for any business website. Crawls the site, fills gaps conversationally, and produces a structured agent-optimized llms.txt. Trigger when a user asks to "generate llms.txt", "create an agentic contract for [url]", "make my site agent-readable", or "update my llms.txt". --- # Samvida — Agentic Contracts for Your Business
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions ask users to paste highly sensitive API tokens, account IDs, and zone IDs into chat without strong warnings or safer alternatives. Secrets shared conversationally may be logged, retained, exposed to other tools, or mishandled by downstream components.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs execution of scripts that modify hosting configuration and redirects on third-party platforms. Infrastructure and routing changes can cause outages, content replacement, or traffic misdirection if the instructions are wrong, abused, or triggered unexpectedly.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
json "runtime": { "python": ">=3.9", "virtualenv": "~/.virtualenvs/samvida", "note": "Skill assumes a Python virtualenv at ~/.virtualenvs/samvida with httpx installed. Generation is handled by your configured OpenClaw LLM \u2014 no separate API key required. Create venv with: python3 -m venv ~/.virtualenvs/samvida && ~/.virtualenvs/samvida/bin/pip install httpx" }, "credentials": { "cloudflare": {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill description in L04 frames the skill as generating an agentic contract by crawling a website and conversing to fill gaps. However, the manifest also defines Cloudflare and Webflow deployment credentials and labels them for a deploy path, which expands the skill beyond generation into publishing/deployment behavior not reflected in the stated description.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - [Pricing](https://utkrusht.ai/pricing): Per-candidate assessment model. No credit card required to start. ## API - [API Docs](https://api.utkrusht.ai/docs): REST API available. Contact for access. ## Links - [Homepage](https://utkrusht.ai)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code assembles and prints raw page text summaries, page URLs, and extracted email addresses from crawled websites. Although the script documents that it outputs JSON, it does not warn that the output may contain personal or sensitive business contact data, which could be logged, stored, or forwarded by downstream tooling.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script’s documented and implemented behavior extends beyond generating llms.txt content into deployment and live hosting modification. In an agent skill advertised as generating an agentic contract, this expanded capability materially increases risk because it can change production infrastructure and site behavior if invoked with credentials.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python print("Missing dependency. Run: pip install httpx", file=sys.stderr) sys.exit(1) CF_API = "https://api.cloudflare.com/client/v4" WF_API = "https://api.webflow.com/v2"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python sys.exit(1) CF_API = "https://api.cloudflare.com/client/v4" WF_API = "https://api.webflow.com/v2"
Dynamic Request Target
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 60% confidence
- Finding
Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.
- Content
python print(f"\n⏳ Verifying redirect is live...") time.sleep(5) try: r = httpx.get(f"https://{domain}/llms.txt", timeout=15, follow_redirects=True) if r.status_code == 200 and "#" in r.text[:10]: print(f"✅ Live at https://{domain}/llms.txt") else:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python 3. Paste the llms.txt content and save """, "default": """ 📋 Your site uses a CMS Samvida can't auto-deploy to yet. Paste the generated llms.txt directly into your CMS at the path /llms.txt. File saved at: /tmp/samvida_llms.txt """,
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill writes a local file and may later overwrite a live llms.txt, but this side effect is not clearly disclosed up front. Insufficient notice can lead to accidental replacement of user content or confusion about where generated artifacts are stored and how they are used.
- Content
Static analysis
No suspicious patterns detected.