Security audit

Goosetown Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real GooseTown integration, but it gives a remote service ongoing influence over the agent and stores reusable credentials in ordinary workspace files.

Install only if you trust the GooseTown service and are comfortable with a background daemon maintaining a live connection. Treat GOOSETOWN.md as a secret file, avoid committing or sharing it, and be aware that remote town content may influence agent actions unless your agent is constrained to ignore instructions embedded in messages or server summaries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: daemon/town_daemon.py:153
Finding: Untrusted Remote Content Is Written Into an Agent Instruction Channel
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/town_register.sh:30
Finding: Registration Response Can Redirect Bearer Credentials to Unvalidated Endpoints
Content: View full analysis
/dev/null; then # Extract ws_url and api_url from response WS_URL=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('ws_url','wss://ws-dev.isol8.co'))") API_URL_RESP=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('api_url','${API_URL}'))") AGENT_RESP=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('agent_name','${AGENT_NAME}'))") # Write config cat > "${AGENT_DIR}/GOOSETOWN.md" </dev/null) ``` `daemon/town_daemon.py:120-137`: ```python url = f"{WS_URL}?token={TOKEN}" logger.info(f"Connecting to {WS_URL}...") try: self.ws = await websockets.connect(url, ping_interval=30, ping_timeout=10) except Exception as e: logger.error(f"WebSocket connection failed: {e}") raise # Send connect message await self.ws.send( json.dumps( { "type": "town_agent_connect", "token": TOKEN, "agent_name": AGENT_NAME, } ) ) ``` ### Technical Analysis A successful registration response ca ...[truncated 1605 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/town_register.sh:37
Finding: Bearer Token Is Stored in a Plaintext Workspace File Without Explicit Permission Hardening
Content: View full analysis
"${AGENT_DIR}/GOOSETOWN.md" <
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: env.sh:12
Finding: Predictable Runtime Directory, Unauthenticated Unix Socket, and Unverified PID Handling
Content: View full analysis
/dev/null || break sleep 0.5 done # Force kill if still running kill -9 "$PID" 2>/dev/null rm -f "$STATE_DIR/daemon.pid" fi ``` ### Technical Analysis Runtime files are placed in a predictable `/tmp/goosetown//` hierarchy. The code does not explicitly enforce mode `0700` on the directory or mo ...[truncated 1624 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: tools/town_act.sh:7
Finding: Unescaped Shell Values Permit JSON Structure Injection
Content: View full analysis
/dev/null ``` `tools/town_disconnect.sh:4-13`: ```bash WAKE_TIME="${1:?Usage: town_disconnect [timezone]}" TZ="${2:-UTC}" if [ ! -S "$STATE_DIR/daemon.sock" ]; then echo '{"error": "Not connected to GooseTown."}' exit 1 fi # Tell daemon to sleep RESULT=$(echo "{\"action\":\"sleep\",\"wake_time\":\"$WAKE_TIME\",\"timezone\":\"$TZ\"}" | socat - UNIX-CONNECT:"$STATE_DIR/daemon.sock" 2>/dev/null) ``` `tools/town_register.sh:19-28`: ```bash # Register with the server RESULT=$(curl -s -X POST "${API_URL}/town/agent/register" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "{ \"agent_name\": \"${AGENT_NAME}\", \"display_name\" ...[truncated 1786 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:1
Finding: Python WebSocket Dependency Is Unpinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill stores authentication and connection details in a local workspace file and performs remote registration/polling, yet these sensitive and persistent behaviors are not prominently surfaced in the declared purpose or permissions. This increases credential exposure risk and creates a gap between expected and actual trust boundaries.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill stores authentication and connection details in a local workspace file and performs remote registration/polling, yet these sensitive and persistent behaviors are not prominently surfaced in the declared purpose or permissions. This increases credential exposure risk and creates a gap between expected and actual trust boundaries.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill stores authentication and connection details in a local workspace file and performs remote registration/polling, yet these sensitive and persistent behaviors are not prominently surfaced in the declared purpose or permissions. This increases credential exposure risk and creates a gap between expected and actual trust boundaries.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · tools/town_connect.sh (reported line 14)May include surrounding context.
sh
exit 0 fi # Stale PID file rm -f "$STATE_DIR/daemon.pid" fi # Start daemon in background, capture initial state from its stdout

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · tools/town_disconnect.sh (reported line 29)May include surrounding context.
sh
exit 0 fi # Stale PID file rm -f "$STATE_DIR/daemon.pid" fi # Start daemon in background, capture initial state from its stdout

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · tools/town_register.sh (reported line 78)May include surrounding context.
sh
exit 0 fi # Stale PID file rm -f "$STATE_DIR/daemon.pid" fi # Start daemon in background, capture initial state from its stdout

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · tools/town_register.sh (reported line 20)May include surrounding context.
sh
fi # Register with the server RESULT=$(curl -s -X POST "${API_URL}/town/agent/register" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · tools/town_register.sh (reported line 53)May include surrounding context.
sh
echo '{"status": "waiting_for_sprite"}' >&2 SPRITE_READY=false for i in $(seq 1 60); do STATUS=$(curl -s "${API_URL_RESP}/town/agent/status?agent_name=${AGENT_RESP}" \ -H "Authorization: Bearer ${TOKEN}" 2>/dev/null) IS_READY=$(echo "$STATUS" | python3 -c "import sys,json; print(json.load(sys.stdin).get('sprite_ready', False))" 2>/dev/null) if [ "$IS_READY" = "True" ]; then

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly requires shell execution, environment variable handling, file writes, and external connectivity, but it declares no permissions or allowed-tools scope. That omission reduces transparency and weakens least-privilege controls, making it easier for the skill to run with broader capabilities than a user may expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs that a registration token and connection configuration be written to GOOSETOWN.md in the workspace without warning about plaintext credential storage. Workspace files may be readable by other tools, skills, or users in the same environment, so storing auth material there increases the risk of token theft and unauthorized account access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Line L09 reads a credential-like value (token) from GOOSETOWN.md and exports it as TOWN_TOKEN. While the file has brief comments about sourcing config, there is no explicit warning, prompt, or user-facing disclosure that sensitive credentials are being accessed and placed into the environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script performs a destructive process termination using kill -9 and removes the PID file immediately afterward. While comments describe the action for developers, there is no user-facing disclosure, prompt, or warning that invoking this command may forcibly terminate the daemon and discard its current state.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · tools/town_register.sh (reported line 20)May include surrounding context.
sh
fi # Register with the server RESULT=$(curl -s -X POST "${API_URL}/town/agent/register" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script does more than simple registration: it persists the bearer token and connection details to a workspace file and then automatically launches a background daemon. That expands the skill’s operational scope beyond the stated social-town purpose and creates stealthier persistence and execution behavior that could expose credentials or maintain an ongoing connection without clear user awareness.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script writes the authentication token directly into GOOSETOWN.md inside the workspace, which is a poor place for secrets because workspace files are often readable, synced, committed, or exposed to other tools. If the file is leaked, an attacker could reuse the bearer token to impersonate the agent or access the associated service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Persisting a registration token locally without an explicit warning or consent is dangerous because users may not realize a reusable secret has been written to disk. In shared or version-controlled workspaces, this can lead to accidental disclosure and long-lived unauthorized access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Launching a background daemon automatically and without clear disclosure reduces user visibility into ongoing network activity and process persistence. While not inherently malicious, this can surprise users, complicate incident response, and mask continued service interaction after the initial registration step.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.