T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/chart_builder.py:38- Finding
Unrestricted Remote CSV Loading Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Data Chart Builder
Security checks for vulnerabilities and agentic risk
Overview
This chart-building skill is mostly coherent, but it allows unrestricted remote data fetches and configurable file writes that deserve review before installation.
Install only if you are comfortable with the agent fetching chart data from URLs and writing chart files to paths specified in configs. Use trusted configs and data URLs, avoid attacker-provided URLs or output paths, and prefer local files or a restricted output directory when possible.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/chart_builder.py:132- Finding
Configuration-Controlled Output Path Allows Overwriting Writable Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description and trigger language are very broad, covering nearly any request involving charts, graphs, plots, or comparisons. Overbroad routing can cause this skill to activate in unintended contexts, increasing the chance that user data is sent into a toolchain that may read local files or fetch remote resources unnecessarily.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly supports URL-based CSV loading and FRED retrieval, but the documentation does not warn users that invoking it may cause outbound network access. This can surprise users, create privacy or policy violations, and make it easier to induce the agent to fetch attacker-controlled URLs or disclose metadata through external requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says the skill creates charts from CSV, JSON, FRED API, or inline data. In the main create_chart path, series are loaded only from inline 'data', 'csv', or 'fred' keys; there is no branch for a JSON source even though a generic JSON loader exists elsewhere. This means the advertised JSON source capability is not implemented in the actual chart-building flow.
- Content