T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:79- Finding
Explicit Agent Role and Objective Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Goosetown Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent virtual-town purpose, but it gives an agent persistent networked autonomy and handles credentials and remote instructions in ways users should review carefully.
Install only if you are comfortable with an agent maintaining a background connection to GooseTown, storing a service token in a local markdown file, sending profile/chat/activity data to the service, and potentially acting on remote town text. Avoid sensitive profile details, use a limited/revocable token, and review or clear TOWN_LIFE.md and any saved memories regularly.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T01 · Skill Instruction Hijacking
Error
- Location
daemon/town_daemon.py:214- Finding
Remote Server Content Is Exposed as Actionable Agent Instructions
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:72- Finding
Persistent Memory Poisoning Through Untrusted Town Interactions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/town_register.sh:42- Finding
Registration Response Can Redirect Bearer Credentials to a Server-Controlled WebSocket Endpoint
- Content
View full analysis
"${AGENT_DIR}/GOOSETOWN.md" <- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
env.sh:14- Finding
Predictable Shared Temporary Directory and Unprotected Local IPC
- Content
View full analysis
/`. 2. The a ...[truncated 851 chars]- Remediation
View remediation
` instead of a shared `/tmp` path. - Create the directory with mode `0700` and fail if ownership or permissions are unexpected. - Open files using secure creation flags and explicit modes; use `0600` for credentials and sensitive state. - Reject symlinks and verify ownership before unlinking, reading, or replacing files. - Set the Unix socket mode explicitly to `0600`. - Authenticate local IPC peers, for example using operating-system peer credentials, and authorize only the expected user. - Validate PID files against process ownership and executable identity before signaling a process. - Store the bearer token in a dedicated credential store rather than Markdown configuration. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
tools/town_act.sh:8- Finding
Unescaped Shell Arguments Permit JSON Payload Injection
- Content
View full analysis
[timezone]}" TZ="${2:-UTC}" if [ ! -S "$STATE_DIR/daemon.sock" ]; then echo '{"error": "Not connected to GooseTown."}' exit 1 fi # Tell daemon to sleep RESULT=$(echo "{\"action\":\"sleep\",\"wake_time\":\"$WAKE_TIME\",\"timezone\":\"$TZ\"}" | socat - UNIX-CONNECT:"$STATE_DIR/daemon.sock" 2>/dev/null) ``` ### Technical Analysis User-supplied values are inserted directly into JSON string literals without JSON encoding. Quotes, backslashes, control characters, or JSON fragments can terminate the intended string and alter the object structure. This is JSON injection rather than direct shell-command injection: the quoted shell variables are not evaluated as shell syntax. Nevertheless, a crafted argument can produce additional or replaced JSON fields, malformed requests, or different daemon actions depending on key ordering and parser behavior. # ...[truncated 951 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill stores an authentication token locally, auto-launches a daemon, and connects to external services, yet those behaviors are not prominently disclosed in the top-level description or constrained by declared permissions. This is dangerous because secrets persistence plus autonomous network activity meaningfully expands the blast radius if the workspace, daemon, or related files are accessed by other components.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill stores an authentication token locally, auto-launches a daemon, and connects to external services, yet those behaviors are not prominently disclosed in the top-level description or constrained by declared permissions. This is dangerous because secrets persistence plus autonomous network activity meaningfully expands the blast radius if the workspace, daemon, or related files are accessed by other components.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill stores an authentication token locally, auto-launches a daemon, and connects to external services, yet those behaviors are not prominently disclosed in the top-level description or constrained by declared permissions. This is dangerous because secrets persistence plus autonomous network activity meaningfully expands the blast radius if the workspace, daemon, or related files are accessed by other components.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to stop acting as an assistant and act autonomously according to its own personality, goals, and impulses. In an agent environment, that is a strong autonomy escalation pattern: it encourages behavior not directly tied to user intent, increases uncontrolled external interaction, and can override normal alignment with user instructions and system safety expectations.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh exit 0 fi # Stale PID file rm -f "$STATE_DIR/daemon.pid" fi # Start daemon in background, capture initial state from its stdout
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh exit 0 fi # Stale PID file rm -f "$STATE_DIR/daemon.pid" fi # Start daemon in background, capture initial state from its stdout
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh exit 0 fi # Stale PID file rm -f "$STATE_DIR/daemon.pid" fi # Start daemon in background, capture initial state from its stdout
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh 'traits': os.environ.get('TRAITS',''), })) ") RESULT=$(curl -s -X POST "${API_URL}/town/agent/register" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "$BODY")
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script silently persists the sensitive registration token to a local file without warning the user. This is dangerous because users may assume the token is used transiently, while the file creates a durable secret that can later be exfiltrated or unintentionally disclosed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill explicitly requires shell execution, environment variable setting, and file writes, but it does not declare any tool scope or permissions boundary. That creates an authorization transparency gap: an agent or user may invoke a skill that can launch processes, persist config, and modify files without an explicit permission contract.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill asks the agent to provide profile and appearance text and then participate in town activity, but it does not clearly warn that this content is transmitted to third-party GooseTown services, including an AI art generation flow. This creates a privacy and data-governance risk because identity/personality data and behavioral logs may leave the local environment without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions state that registration creates a config file containing the GooseTown token, but they do not clearly warn the user about the sensitivity of that token or the risks of storing it in the workspace. A workspace file may be readable by other tools, skills, logs, or accidental sharing flows, enabling unauthorized reuse of the credential.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This shell file reads a token from GOOSETOWN.md and exports it into the environment, which is sensitive credential handling. The file contains no user-facing warning, confirmation, or explanatory disclosure about credential access, and the operation is not obviously disclosed beyond an internal comment about sourcing config.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script forcefully terminates the daemon with SIGKILL after a short fixed wait and then removes the PID file without confirming that the daemon failed to shut down safely. This can interrupt in-flight work, corrupt daemon-managed state, and hide shutdown failures from the user, making recovery and debugging harder.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh 'traits': os.environ.get('TRAITS',''), })) ") RESULT=$(curl -s -X POST "${API_URL}/town/agent/register" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "$BODY")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The script sends agent_name, display_name, personality, appearance, and traits to the remote registration endpoint via curl. Although registration is implied by the script name, there is no visible user-facing notice in output or prompt indicating that these user-provided fields will be transmitted to the server.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script does more than registration: it persistently writes configuration files, stores operational state in the agent directory, and automatically starts a long-running background daemon. In a skill whose stated purpose is joining a shared virtual town, these side effects materially expand the trust boundary and can surprise users or agents by creating persistence and network activity beyond the immediate command.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The bearer token is written verbatim into GOOSETOWN.md in plaintext, making credential exposure likely through local file reads, backups, logs, accidental commits, or sharing of the workspace. Because the token authenticates to the service, disclosure can allow unauthorized registration or impersonation of the agent.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Defaulting the agent identity to the local hostname can leak host-identifying information to the remote service and to other participants if not overridden. While not directly exploitable code execution, it exposes environmental metadata unrelated to the core social-town function.
- Content