T09 · Insecure Skill Coding Practices
Warning
- Location
scraper.py:400- Finding
Spreadsheet Formula Injection in CSV Exports
- Content
View full analysis
- Remediation
View remediation
Security audit
PicoClaw Financev
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed LinkedIn job-scraping skill with user-directed exports, but users should treat CSV output and dependency installation cautiously.
Install in a virtual environment, review LinkedIn ToS and rate-limit implications, save output only to intended paths, and prefer JSON or sanitize CSV data before opening it in spreadsheet applications.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:147- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documentation advertises capabilities that imply network access and file read/write behavior, but the manifest shown in SKILL.md does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can cause the skill to run with broader default privileges than reviewers or users expect, increasing the risk of unintended scraping, data exfiltration, or filesystem writes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The main skill description and usage guidance are written in Portuguese, but the file does not offer an alternative language or indicate that the skill is intentionally limited to Portuguese-speaking users. This can violate language/locale policy when users are not given an explicit opt-in or choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code checks that SKILL.md contains the Portuguese phrase "Boas Práticas," effectively enforcing a specific language in project documentation. That is a natural-language locale policy concern because it requires a locale-specific term without any indication of user opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The primary descriptive text is presented in Portuguese, which imposes a specific language on users without indicating that alternatives are available. This can violate language/locale policy when a skill does not offer user choice or clearly justify the locale restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The user-facing tagline and description are entirely in Portuguese, while the manifest does not state that the skill is intended only for Portuguese-speaking users or a Brazil/Portugal-specific audience. Under the language/locale policy, forcing a specific language without opt-in or justification can be a natural-language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The scraper hard-codes the
Accept-Languageheader toen-US,en;q=0.5, which imposes an English/US locale on all requests. This is a natural-language/locale policy concern because the skill does not offer any user choice or document a justified region-specific constraint.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest frames the skill as a web scraping utility for extracting job data without authentication. In addition to scraping, the code provides persistent export capabilities to arbitrary CSV/JSON files, which is a broader behavior than simple extraction and is not mentioned in the manifest description.
- Content