T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.js:51- Finding
Terminal Escape-Sequence Injection Through an Untrusted URL Argument
- Content
View full analysis
- Remediation
View remediation
Security audit
The Fed Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Fed and macroeconomic analysis aid with bounded network use, but users should treat its market guidance and bundled demo script cautiously.
Install only if you want an agent to fetch news URLs and produce macro/market analysis. Treat outputs as analytical commentary, not financial advice, and do not rely on scripts/analyze.js for real article analysis because it is a placeholder demo. Use trusted URLs and be cautious running the script directly with arbitrary input.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md Read `references/frameworks.md` for detailed analytical models when complex macroeconomic situations require deeper assessment. ## Output Guidelines - **Be decisive** — provide clear probabilities, not vague ranges - **Anchor to frameworks** — cite specific indicators from the loaded models
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs use of
web_fetchon a user-provided URL, but the manifest declares no tool scope or allowed-tools restrictions. That creates an authorization and review gap: consumers cannot easily tell the skill performs network access, and platforms cannot enforce least-privilege boundaries for this skill.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger description is very broad and overlaps with common news and macroeconomic discussions, making accidental invocation more likely in unrelated contexts. Over-broad routing increases the chance this skill fetches external content or influences outputs when a narrower, safer skill would have been more appropriate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow states the skill will fetch a supplied news URL, but the user-facing description does not clearly warn that external content will be retrieved. This reduces informed consent and increases the risk of users unintentionally causing remote fetches to untrusted domains, which is especially relevant in a URL-driven skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script claims to analyze news from a supplied URL, but it never fetches or processes the article and instead returns fabricated placeholder output. This is dangerous because users may rely on the result as if it were evidence-based macroeconomic analysis, leading to misinformation and potentially poor financial or policy decisions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata advertises sophisticated Fed, inflation, and monetary-policy analysis, but the implementation only emits canned text regardless of input. In the context of a financial-analysis skill, this mismatch is especially risky because it can create false trust in non-existent analysis and mislead downstream users or agents acting on market-sensitive information.
- Content