T09 · Insecure Skill Coding Practices
Error
- Location
mcp_connector/api_client.py:190- Finding
API Credential and Quote Data Can Be Sent to an Arbitrary or Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
chip-trade-skills
Security checks for vulnerabilities and agentic risk
Overview
The connector is mostly purpose-aligned, but its privacy and network boundaries are under-disclosed for a tool that handles API keys, customer identifiers, and ERP inventory data.
Review this before installing in any real procurement or customer-data workflow. Use only a trusted HTTPS quote endpoint, scope and rotate the API key, avoid sending real customer identifiers, and treat remote advisory text as untrusted market data rather than instructions for the agent. Run it with access only to the intended inventory file.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
mcp_connector/api_client.py:155- Finding
Undisclosed Customer Identifier Is Transmitted to the Remote Service
- Content
View full analysis
RemoteQuote: """ Call GET /v1/quote on the remote api_engine and return a RemoteQuote. Parameters ────────── part_number Part number to query (will be normalised server-side). qty Requested quantity. 0 = unspecified. customer_id Optional opaque ID for server-side logging only. ``` ```python # mcp_connector/api_client.py:190-198 params: dict[str, Any] = { "part_number": part_number, "qty": qty, "lang": lang, } if customer_id: params["customer_id"] = customer_id ``` ```python # mcp_connector/server.py:84-89 "customer_id": { "type": "string", "description": "Optional opaque customer identifier", "default": "", }, ``` ```python # mcp_connector/server.py:145-165 def _handle_quote_part(args: dict) -> str: part = str(args.get("part_number", "")).strip().upper() qty = int(args.get("qty", 0)) cid = str(args.get("customer_id", "")).strip() if not part: return "❌ Error: part_number is required." try: q = fetch_quote(part, qty=qty, customer_id=cid) ``` The documentation states: ```markdown # README.md:181-184 and SKILL.md:193-196 ## Privacy Guarantee This connector enforces a strict data boundary: - **Sent to server:** `part_number`, `qty`, `lang` — nothing else ``` ### Technical Analysis The documented privacy guarantee states that only `part_number`, `qty`, and `lang` are transmitted. The implementation additionally accepts and sends `customer_id`. Its stated purpose is r ...[truncated 1517 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
mcp_connector/merger.py:217- Finding
Remote Advisory Content Is Inserted into MCP Agent Context Without Trust Controls
- Content
View full analysis
{view.advisory}", ] return "\n".join(lines) ``` ```python # mcp_connector/server.py:256-269 hand ...[truncated 2787 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:43- Finding
Runtime Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
2. Configure environment
bash cp .env.example .env # Edit .env: # QUOTE_ENGINE_URL = https://api.ic-navigator.com (or your self-hosted URL) # QUOTE_ENGINE_API_KEY = JAY-IC-xxxxxxxxxxxxxxxxxxxx
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Output as JSON (for ERP integration) python -m mcp_connector.client quote STM32L412CBU6 --json ENVIRONMENT VARIABLES (set in .env or shell) ───────────────────────────────────────────── QUOTE_ENGINE_URL — https://your-engine.example.com QUOTE_ENGINE_API_KEY — your X-API-Key credential
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Output as JSON (for ERP integration) python -m mcp_connector.client quote STM32L412CBU6 --json ENVIRONMENT VARIABLES (set in .env or shell) ───────────────────────────────────────────── QUOTE_ENGINE_URL — https://your-engine.example.com QUOTE_ENGINE_API_KEY — your X-API-Key credential
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The docstring promises that pricing columns are NEVER read, regardless of presence. But _build_index skips columns only when their actual header text matches price keywords; if a user maps stock_qty, package, or date_code to a non-keyword pricing header name, the code will index and extract that column, contradicting the stated guarantee.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description explicitly labels the connector as 'Taiwan-neutral', which is a locale/political framing applied by default rather than presented as an optional mode. The file does not clearly state that users can opt into or disable this locale-specific filtering, so it may violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The architecture section lists 'Taiwan-neutral filtering' as an inherent server-side function, suggesting the skill applies a specific locale/policy lens automatically. Although advisory output languages are selectable elsewhere, this policy-sensitive filtering itself is not presented as user-selectable or justified as mandatory for a narrowly regional tool.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module-level documentation states that only part_number, qty, and lang are sent to the remote engine, but fetch_quote also includes customer_id when provided. This mismatch can cause callers to transmit identifying or sensitive data off-host under a false assumption, creating a real privacy and data-governance risk in a connector explicitly framed around minimizing outbound data.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation promises that only part number, quantity, and language are transmitted, but the implementation also forwards customer_id to the remote service. This creates a privacy and trust boundary mismatch: operators may supply customer identifiers believing they are local-only or may rely on the stated guarantee for compliance decisions, causing unintended disclosure of potentially sensitive metadata.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The design narrative emphasizes minimal single-record extraction, but read_all and the batch helpers iterate and return all inventory rows from the local ERP file. In this skill context, that broadens access from targeted lookup to bulk exfiltration of inventory metadata, increasing confidentiality risk if the skill is invoked by an untrusted workflow or exposed agent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module’s privacy contract states that only part number and quantity are eligible for extraction, but the implementation also returns supply status, package, and date code. This is a real data-minimization/privacy-boundary violation because downstream callers may rely on the documented contract and unintentionally expose additional ERP metadata.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code hard-codes user-visible recommendation strings in Traditional Chinese, and the formatter later also emits fixed Traditional Chinese labels. The applicable policy rule flags language/locale constraints when a specific language is forced without offering user choice or documenting a justified locale limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The docstring explicitly states that labels are in Traditional Chinese, and the generated table headers and action/risk labels are all fixed in that locale. Under the policy, this is a natural-language locale restriction unless the skill provides opt-in language selection or clearly documents a justified region-specific scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The public API sets
lang: str = "en"and documents English as the default advisory language. Under the policy, forcing a specific language without explicit user choice or opt-in is a natural-language locale policy issue unless clearly justified.- Content
Rp1
Low
- Category
- MCP Rug Pull
- Confidence
- 60% confidence
- Finding
pip install without ==version installs the latest release, which could include malicious changes.
- Content
Rp1
Low
- Category
- MCP Rug Pull
- Confidence
- 60% confidence
- Finding
pip install without ==version installs the latest release, which could include malicious changes.
- Content
Static analysis
No suspicious patterns detected.