T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:19- Finding
Mandatory Public Upload Instructions Can Disclose Local Files to a Third Party
- Content
View full analysis
- Remediation
View remediation
Security audit
Giggle Files Management
Security checks for vulnerabilities and agentic risk
Overview
This skill uploads files as advertised, but it can push agents to publicly upload local files too broadly without clear confirmation.
Install only if you are comfortable with agents uploading selected files to Giggle/S3 and receiving public links. Use it only for files you intentionally want externally hosted, and avoid private documents, source code, credentials, logs, or business data unless you have confirmed the exact file and sharing scope.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/upload.sh:82- Finding
Unvalidated Presigned URL Permits File Upload to an Arbitrary Destination
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/upload.sh:70- Finding
Unescaped Values Are Interpolated into JSON Request Bodies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to upload files and return public/download URLs but does not clearly warn that files are sent to an external service and may become publicly accessible. This undermines informed consent and creates a real risk of accidental disclosure of private documents, images, or other sensitive artifacts.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes shell scripts but does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent can execute the upload workflow without clear policy gating or review, making unintended file exfiltration to an external service more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation guidance is overly broad and says to always upload files when needing to send, show, or share them, including as a standard fallback for many channels. In practice, this can cause the agent to upload ordinary local or generated files to a third-party service without checking whether the user intended external hosting or whether the content is sensitive.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # Usage: upload.sh <file_path> [custom_filename] API_BASE="https://api.giggle.pro/api/v1/assets" # --- Resolve API key (GIGGLE_ASSET_SERVICE_KEY > STORYCLAW_API_KEY) --- API_KEY="${GIGGLE_ASSET_SERVICE_KEY:-${STORYCLAW_API_KEY:-}}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This request sends file metadata, filename, content type, and an API key to an external service to obtain a presigned upload URL. External transmission is expected for the skill's purpose, but in a security review it is still a real data-exfiltration boundary, especially because the workflow ultimately publishes the uploaded file and may operate on arbitrary local paths.
- Content
sh CONTENT_TYPE="$(detect_content_type "$CUSTOM_NAME")" # --- Step 1: Get presigned URL --- PRESIGN_RESP="$(curl -sS -X POST "$API_BASE/get-presigned-url" \ -H "Content-Type: application/json" \ -H "Accept: */*" \ -H "x-api-key: $API_KEY" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script is explicitly designed to upload a local file and associated metadata to a remote asset service, but it provides almost no user-facing warning about the transfer or that the asset is requested as public (
is_public:true). In an agent/skill context, this can lead to unintended exfiltration of sensitive local files because the action is automated and the resulting URLs may expose the content publicly.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This registration call transmits object metadata to the external API and finalizes creation of a remotely accessible asset. In this context, it increases risk because it completes the publication workflow and returns public/download URLs, making accidental disclosure more harmful than a transient outbound request alone.
- Content
sh fi # --- Step 3: Register asset --- REGISTER_RESP="$(curl -sS -X POST "$API_BASE/register" \ -H "Content-Type: application/json" \ -H "Accept: */*" \ -H "x-api-key: $API_KEY" \
Static analysis
No suspicious patterns detected.