T09 · Insecure Skill Coding Practices
Error
- Location
references/architecture.md:575- Finding
Incomplete SSRF Address Validation in Recommended Security Pattern
- Content
View full analysis
- Remediation
View remediation
Security audit
Dhh Rails Style
Security checks for vulnerabilities and agentic risk
Overview
This Rails style skill is mostly documentation, but it needs Review because it includes an incomplete SSRF protection pattern that could lead generated apps to unsafe code.
Install only if you want broad DHH/37signals Rails style guidance, and review generated security-sensitive code yourself. Do not copy the SSRF protection snippet as-is; use a complete outbound request policy with proper IP classification, scheme and port allowlists, redirect validation, timeouts, response limits, and tests. Also add your own privacy limits before collecting IP address, referrer, user agent, or similar request metadata.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 3, view, frontend, turbo, stimulus, css | [frontend.md](./references/frontend.md) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 3, view, frontend, turbo, stimulus, css | [frontend.md](./references/frontend.md) |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
ruby # Instead of this: POST /cards/:id/close DELETE /cards/:id/close POST /cards/:id/archive # Do this:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
ruby # Instead of this: POST /cards/:id/close DELETE /cards/:id/close POST /cards/:id/archive # Do this:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Do this:
POST /cards/:id/closure # create closure DELETE /cards/:id/closure # destroy closure POST /cards/:id/archival # create archival
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Do this:
POST /cards/:id/closure # create closure DELETE /cards/:id/closure # destroy closure POST /cards/:id/archival # create archival
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill declares very broad activation triggers such as any Ruby/Rails code generation, refactoring, code review, or mentions of DHH/37signals-related terms. That can cause the skill to activate on many ordinary development requests outside a narrowly scoped style-guidance use case, increasing the chance that its instructions override more appropriate task-specific or security-focused guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill recommends storing request ID, user agent, IP address, and referrer in a global Current context without any privacy guidance, data minimization, retention limits, or warnings about sensitive handling. In a code-generation skill, this can normalize pervasive collection of identifying metadata and lead downstream implementations to log, persist, or expose it in ways that create privacy and compliance risk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This markdown file includes a code example that writes arbitrary content to the user's clipboard via
navigator.clipboard.writeText, but the surrounding documentation does not mention that the action copies data outside the page context. For markdown files, SQP-2 applies when behaviour affecting user data or privacy is described without warning, and clipboard access merits a brief disclosure.- Content