T09 · Insecure Skill Coding Practices
Error
- Location
scripts/talebook_api.py:80- Finding
Credentials May Be Transmitted in Plaintext to an Unrestricted or Redirected Host
- Content
View full analysis
- Remediation
View remediation
Security audit
Talebook
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent Talebook/MyBooks integration, but it sends credentials and files to a user-configured server without enough transport, destination, or confirmation safeguards.
Review before installing. Use this only with a Talebook/MyBooks server you control, preferably over HTTPS; avoid LAN or public HTTP hosts for credentials. Use a least-privileged Talebook account, confirm any upload path or book-push destination yourself, and do not provide paths to sensitive non-book files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The file contains outbound HTTP client functionality to a user-configured host, yet network capability is not covered by declared permissions. In a skill ecosystem this is dangerous because it allows data exfiltration, authenticated server actions, and communication with arbitrary endpoints without transparent permissioning.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The file contains outbound HTTP client functionality to a user-configured host, yet network capability is not covered by declared permissions. In a skill ecosystem this is dangerous because it allows data exfiltration, authenticated server actions, and communication with arbitrary endpoints without transparent permissioning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill supports sending books to external email addresses and LAN-connected reader devices, but the documentation does not clearly warn that book contents and recipient/device identifiers will be transmitted off-agent to external destinations. This can lead to unintended data disclosure, especially if a user asks to send copyrighted or sensitive documents without realizing the transfer leaves the local environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The upload feature accepts an absolute local file path and transfers that file into the Talebook/MyBooks service, but the documentation does not clearly state that local data will be copied to a remote service. Without an explicit warning, users may provide sensitive local files under the mistaken assumption the action is purely local metadata management.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script automatically signs in using credentials from the environment before each tool invocation, without any user-facing disclosure at execution time. In this skill context, that means even seemingly read-only actions trigger credentialed access to a remote service, reducing user awareness and increasing the chance of unintended authenticated operations against an attacker-controlled or misconfigured host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The book_upload path reads a local file and uploads its contents to a remote server with no in-code warning, confirmation, or restriction beyond existence checking. In an agent environment this is sensitive because a user may not realize a local path will cause direct file exfiltration to the configured server, and TALEBOOK_HOST is externally configurable.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python Returns: Tool execution result """ tool_method = getattr(self, tool_name, None) if tool_method is None or not callable(tool_method): available_tools = [
Static analysis
No suspicious patterns detected.