T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:258- Finding
Unrestricted Remote Specification Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Phy Openapi Sec Audit
Security checks for vulnerabilities and agentic risk
Overview
This OpenAPI scanner is mostly purpose-aligned, but its URL scanning can fetch arbitrary HTTP/HTTPS locations from the agent's environment without safeguards or a clear warning.
Review this before installing if you will scan URLs from a CI runner, cloud VM, corporate network, or agent environment with access to internal services. Prefer local spec files, avoid scanning untrusted URLs, and use network egress controls or a sandbox if remote URL scanning is needed. Install PyYAML in an isolated environment and pin dependencies where reproducibility matters.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:153- Finding
Unpinned PyYAML Installation Creates a Mutable Supply-Chain Dependency
- Content
View full analysis
spec.json" ) ``` ### Technical Analysis The Skill directs users to install `pyyaml` without a version constraint, lock file, integrity hash, or approved package-index configuration. Consequently, installation resolves to whatever release and distribution artifact the configured package index serves at installation time. The implementation correctly uses `yaml.safe_load`, which reduces unsafe YAML object-deserialization risk. The finding concerns dependency acquisition rather than the parser API. An unpinned installation is mutable and cannot be reliably reproduced or verified against the version reviewed during the Skill audit. This does not demonstrate that the current PyYAML package is malicious. The risk arises if an upstream release, package repository, mirror, DNS path, or local pip configuration becomes compromised or serves an incompatible artifact. ### Attack Path 1. A user attempts to scan a YAML OpenAPI document without PyYAML installed. 2. The scanner instructs the user to run `pip install pyyaml`. 3. Pip queries its configured package index and selects the latest matching artifact because no version or hash is specified. 4. A compromised index, mirror, upstream release, or package-resolution configuration supplies a malicious or unreviewed distribution. 5. Package installation code executes with the privileges of the user or automation environmen ...[truncated 933 chars]- Remediation
View remediation
\ --hash=sha256: ``` 3. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Review and update the pinned version through a controlled dependency-update process. 5. Configure CI and production environments to use an approved package index or internal artifact mirror. 6. Prefer isolated virtual environments and avoid administrator-level installation. 7. Generate and retain a software bill of materials for released versions. 8. Add dependency vulnerability and provenance checks to CI. 9. Update both the installation section and runtime error message so they reference the pinned requirements file rather than an unconstrained `pip install pyyaml` command. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ============================================================ ── CRITICAL (1) ──────────────────────────────────────────── 🔴 OS008 [CRITICAL] DELETE /admin/users/{id} Admin/internal path '/admin/users/{id}' has no authentication requirement. CWE: CWE-285: Improper Authorization Fix: Add strict authentication + scope requirement to this endpoint.
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 75% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
md ### OS008 — Admin/Internal Path Without Auth (CRITICAL) Flags paths matching `/admin`, `/internal`, `/debug`, `/_internal`, `/_debug`, `/management`, `/actuator`, `/metrics`, `/health/detail`, `/swagger-ui`, `/api-docs` that have no security requirement. These are the most exploited endpoints in API breaches. ### OS009 — File Upload Without Size Limit `multipart/form-data` and `application/octet-stream` endpoints where binary fields lack `maxLength` or `maximum`. An unbound upload endpoint is a trivial denial-of-service vector. ### OS010 — Wildcard OAuth Scope
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md check_id="OS010", severity="HIGH", path=f"securitySchemes/{name}/scopes/{scope}", message=f"OAuth scope '{scope}' is overly broad. A compromised client with this scope has unrestricted API access.", cwe="CWE-272: Least Privilege Violation", fix="Replace wildcard scopes with specific resource:action scopes (e.g. 'users:read', 'orders:write'). Never grant * or bare admin scope.", ))
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly supports fetching OpenAPI specs from arbitrary HTTP/HTTPS URLs, which causes an outbound network request to attacker-controlled destinations. While this is expected functionality for a scanner, failing to clearly warn users about the network contact can enable unintended requests to internal, sensitive, or monitored endpoints and may expose requester metadata.
- Content