T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:256- Finding
Authenticated requests may be sent through a TLS connection with certificate verification disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentArts To OfficeAce
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent AgentArts skill generator, but it generates code that stores API keys in plaintext and can send authenticated requests through unsafe or overly flexible network paths.
Review before installing. Do not use this with production AgentArts credentials unless you first change the generator so generated skills require AGENTARTS_API_KEY at runtime and never write the key to disk. Remove the IP-direct TLS fallback, restrict base URLs to approved HTTPS AgentArts hosts, and use only a dedicated output directory with simple skill names.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:985- Finding
AgentArts API keys are embedded as plaintext fallback credentials in generated Skills
- Content
View full analysis
/scripts/invoke_agentarts.py`. 4. The ...[truncated 856 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:837- Finding
Runtime endpoint overrides can redirect API credentials and workflow data to arbitrary hosts
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:964- Finding
Unsanitized Skill names permit output-directory traversal and predictable file overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented purpose is a simple skill generator, but the detected behavior expands into secret embedding, active network invocation logic, SSL-bypass/direct-IP fallback, and undeclared output post-processing. This mismatch is dangerous because users may approve or run the factory under false assumptions, while the generated code can weaken transport security and persist credentials in artifacts.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The template explicitly embeds API keys into generated code and documentation, causing secrets to be persisted in plaintext in files that are likely to be stored, copied, or committed to source control. In the context of a skill factory, this is especially dangerous because it systematically propagates credentials across every generated artifact, increasing the blast radius of a single operator mistake.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The generator writes output files containing API credentials without an explicit warning, which materially increases the chance of accidental secret disclosure through local storage, backups, logs, or repository commits. Because this is a factory, the insecure pattern is replicated into each generated skill, multiplying exposure across environments and users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README includes an example command that passes the API key directly on the command line, which commonly exposes secrets through shell history, terminal logs, CI logs, and process listings visible to other local users. In a skill factory context, this is especially risky because users are encouraged to copy-paste the example, potentially propagating insecure secret-handling practices into many generated skills and operational workflows.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares operational requirements and instructs use of environment variables, filesystem generation, and network-capable generated code, but does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent runtime grants broader capabilities than users expect, especially because the skill can create files and handle secrets while preparing invoker code.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs collection of an API key and reuse of that secret in generated commands and code artifacts. Persisting bearer tokens in files or templated source increases the risk of accidental commits, artifact leakage, local compromise, and reuse by unauthorized users.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The example generation command encourages users to place a bearer token directly in a shell command, exposing it to command history, process-table inspection, and logging. This is a concrete secret-disclosure risk, not just a documentation concern, because users often copy examples verbatim.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example command passes a bearer token directly on the command line, which can leak via shell history, process listings, audit logs, and CI job output. Because this skill is specifically about packaging reusable integrations, the example encourages insecure secret-handling habits that may be copied into production workflows.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The validation and delivery steps normalize checking generated configuration values that include default secret fields, reinforcing a workflow where credentials persist inside code/config artifacts. In a factory skill that mass-produces integrations, this can scale secret sprawl across multiple generated skills and repositories.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated SKILL.md template is written in Chinese and includes fixed Chinese headings, instructions, and sample output, which forces a specific language/locale on downstream users. The file does not offer any user opt-in or configuration for language selection, matching the language-policy violation criteria.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template instructs the agent to return raw upstream permission-error content directly to the user. Raw backend error bodies often contain internal identifiers, policy names, resource paths, account data, or implementation details that can aid enumeration and targeted follow-on attacks; in a generated skill context, this insecure disclosure policy is propagated by default to every skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This skill is described as a factory that quickly wraps AgentArts workflows into standard skill directories from connection and auth parameters. But the generated invoker includes broad result-inspection logic for numeric extraction, normal-range parsing, and abnormal metric detection, which is a specialized analytical capability unrelated to simply packaging arbitrary workflows.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated invoker prints raw permission-error payloads to output, directly implementing the insecure disclosure behavior described in the template. This can leak backend details to end users or operators viewing console output, and because it is built into the factory, the behavior becomes a repeatable default across all generated clients.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The default behavior text inserted into generated SKILL.md says the first API call should only output the cloud workflow result and should not automatically perform follow-up analysis. However, the generated invoke_agentarts.py template automatically scans successful responses for out-of-range indicators and prints derived analysis summaries, which is a substantive contradiction between embedded documentation and code behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
These defaults define user-visible generated content entirely in Chinese, including behavior rules and example phrasing, without any mechanism for locale choice. This imposes a language policy decision in natural-language content rather than adapting to or asking for user preference.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script outputs a summary including part of the API key after generating files that contain the credential. For code files, handling sensitive credentials is a safety-relevant operation, and there is no user-facing warning in this script that it will process and persist the secret beyond this partial masking.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Natural-language policy violations include forcing a specific language without user opt-in. This skill's manifest description, trigger text, and operating instructions are all Chinese-only, and there is no indication that users may choose another language or that the language restriction is intentional and justified.
- Content
Static analysis
Detected: suspicious.insecure_tls_verification
HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- scripts/main.py:266