T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_paste.sh:20- Finding
Paste Password Transmitted in URL Query String
- Content
View full analysis
- Remediation
View remediation
Security audit
copy-paste.cloud
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent pastebin integration, but users should avoid sending secrets because created pastes and credentials are handled by shell scripts and a third-party service.
Install only if you are comfortable sending selected content and your COPYPASTE_API_KEY to copy-paste.cloud. Treat non-private pastes as public, do not paste credentials, tokens, private source code, regulated data, or sensitive internal material, and avoid using password-protected paste retrieval for secrets until the password-in-URL handling is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create_paste.sh:78- Finding
API Credentials and Paste Data Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code chunk is a shell script solely for creating a paste using the copy-paste.cloud API. It validates inputs, constructs a JSON payload, and sends a POST request to /api/v1/pastes with an API key. There is no logic for listing recent public pastes or reading an existing paste by ID. Because the declared description explicitly includes read capabilities that are absent from the actual code chunk, the description does not accurately represent what this supplied code actually does.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README encourages users to upload arbitrary file contents, including examples like
$(cat myfile.py)and 'secret snippet', to a public pastebin but does not clearly warn that pastes may be publicly accessible, retained, or exposed through misconfiguration or user misunderstanding. In a skill whose primary purpose is publishing content to a third-party paste service, this omission increases the risk of accidental disclosure of source code, credentials, proprietary data, or other sensitive material.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares shell execution and network-capable behavior but does not define any explicit tool scope such as permissions or allowed-tools. That omission weakens containment and reviewability, making it easier for an agent runtime to invoke broader capabilities than users may expect when handling untrusted paste content or publishing data externally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The skill explicitly transmits an API key to an external service and can send arbitrary user-provided paste content off-host. In this skill's context that behavior is expected, but it is still security-relevant because users may unintentionally exfiltrate sensitive data or secrets to a third-party paste service.
- Content
md | URL | Method | Data sent | |-----|--------|-----------| | `https://api.copy-paste.cloud/api/v1/pastes/recent` | GET | API key (header) | | `https://api.copy-paste.cloud/api/v1/pastes/{id}` | GET | paste ID (path) | | `https://api.copy-paste.cloud/api/v1/pastes` | POST | API key (header), paste content, metadata |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | URL | Method | Data sent | |-----|--------|-----------| | `https://api.copy-paste.cloud/api/v1/pastes/recent` | GET | API key (header) | | `https://api.copy-paste.cloud/api/v1/pastes/{id}` | GET | paste ID (path) | | `https://api.copy-paste.cloud/api/v1/pastes` | POST | API key (header), paste content, metadata | ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This endpoint sends both an API key and paste content/metadata to an external service, which creates a clear data-exfiltration path. Because the skill is specifically designed to publish text, the risk is contextual rather than malicious, but it becomes dangerous if agents can post local secrets, proprietary code, or user data without strong confirmation.
- Content
md |-----|--------|-----------| | `https://api.copy-paste.cloud/api/v1/pastes/recent` | GET | API key (header) | | `https://api.copy-paste.cloud/api/v1/pastes/{id}` | GET | paste ID (path) | | `https://api.copy-paste.cloud/api/v1/pastes` | POST | API key (header), paste content, metadata | ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh expiresInHours: (if $expires != "" then ($expires | tonumber) else null end) }') response=$(curl -sS --fail-with-body \ -X POST "${API_BASE}/api/v1/pastes" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code performs an outbound HTTP request and transmits a bearer token from an environment variable, but there is no confirmation prompt, log message, or nearby comment disclosing that authenticated network access will occur. For a code file, safety-relevant external communication using credentials should include some visible user disclosure unless clearly documented as part of the skill's stated purpose.
- Content