T09 · Insecure Skill Coding Practices
Error
- Location
AGENTS.md:454- Finding
Caller Source Code Is Sent to a Cloud AI Provider by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
Console Agent
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent guide for a cloud-backed AI debugging library, but its default behavior can automatically send caller source code and rich runtime data to an external AI provider with limited upfront warning.
Install only if you are comfortable with prompts, context, attached files, logs, and caller source code being sent to the configured AI provider. For sensitive projects, disable includeCallerSource, prefer localOnly or Ollama where practical, avoid fire-and-forget in production paths, redact logs and objects before calling the agent, and pin reviewed package versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
AGENTS.md:295- Finding
File-Analysis Guidance Permits Unrestricted Transmission of Local Documents
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:76- Finding
Installation Instructions Use Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatic source-file inclusion is a substantive data-exfiltration risk because surrounding code often contains secrets, credentials, internal endpoints, security controls, and proprietary implementation details. In a runtime utility marketed as drop-in and zero-config, this default is especially dangerous because it can occur broadly and invisibly across many call sites.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation presents conflicting security semantics: personas list 'default tools' while the tools section says tools are opt-in only. In an agent skill, ambiguity around whether web search, code execution, or file analysis may run automatically can cause developers to unintentionally enable external actions or data transfer they did not consent to.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
javascript const result = await console.agent( "Summarize the API at https://api.example.com/docs", null, { tools: ['url_context'] } );
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The examples encourage attaching PDFs, images, and code files for AI analysis but do not clearly warn that these files may be transmitted to an external service. This can lead developers to send sensitive documents or regulated data without informed consent or review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document normalizes automatic source-code transmission without an upfront, prominent privacy warning. Users may adopt the library assuming ordinary logging-like behavior and not realize code is sent to a remote model provider, creating hidden privacy and compliance risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The troubleshooting guidance recommends sending rich request, response, logs, and environment context, which commonly include PII, credentials, tokens, and operationally sensitive metadata. Encouraging broad context sharing to remote AI increases the likelihood of oversharing sensitive production data during debugging.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The introductory material identifies the package and provider but does not clearly warn that using the skill may transmit prompts, code, logs, runtime context, or source material to Google-hosted models and tools. Given the skill's stated use cases—debugging, security auditing, intelligent logging, and runtime analysis—users may disclose sensitive information without realizing it leaves the local environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'When to Apply' section is broad enough to trigger on many ordinary programming, debugging, and security-related requests, which can cause this skill to be invoked in contexts where users did not explicitly ask to use an external AI agent. In this skill, overbroad activation matters because the examples and defaults encourage sending code, logs, runtime context, and possibly source files to a cloud provider.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The testing and debugging snippets promote forwarding raw order objects, batch inputs/outputs, and error details to the agent, normalizing transmission of potentially sensitive transactional and test data. In practice, test fixtures and failure payloads often contain realistic customer data, secrets, and internal system details, so this creates a meaningful confidentiality risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file attachment example encourages reading a local PDF and passing its raw bytes to the agent without a nearby warning that the document contents may be uploaded to an external provider for analysis. This creates a direct path for exfiltration of confidential local files under normal usage patterns, especially because the example is framed as a standard feature rather than a sensitive operation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
These best-practice examples explicitly encourage sending rich debugging context such as errors, orders, users, timestamps, environments, and recent logs. Even with anonymization enabled, such data often contains secrets, personal data, tokens, internal identifiers, or business-sensitive content that automated stripping may miss, making semantic data leakage likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The troubleshooting example advises sending full request objects, response bodies, logs, and environment context when diagnosing API 500s. That pattern is especially risky because such payloads commonly include credentials, session tokens, PII, internal endpoints, and stack traces, and users may follow the example during production incidents when sensitive data is most exposed.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documents automatic inclusion of the caller's source file as default behavior, which can transmit surrounding code, comments, secrets, and business logic to the AI service without deliberate opt-in. Even with anonymization claims elsewhere, source code may contain proprietary logic or sensitive literals that are not reliably scrubbed.
- Content