T09 · Insecure Skill Coding Practices
Warning
- Location
verify_skill.py:11- Finding
Test workflow writes an unencrypted private key and may leave it on disk after failure
- Content
View full analysis
- Remediation
View remediation
Security audit
Artifact Signing
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says at a high level, but it handles signing keys in ways users should review carefully before trusting it for real artifact signing.
Install only if you understand that this is raw private-key signing, not certificate-chain signing. Do not use the provided plaintext key-generation example for production keys; use encrypted keys or a secure key store, restrict file permissions, and verify exactly which artifact and output path the agent will use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
examples/usage.md:19- Finding
Usage documentation encourages creation of an unencrypted private-key file without explicit access controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims signing with a digital certificate and private key, but the documented behavior only references a PEM private key and detached signature generation. This mismatch can mislead users or downstream agents into assuming certificate-backed trust properties, causing incorrect security decisions about artifact provenance and verification.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill exposes shell execution behavior via an example command and implied script invocation, but it does not declare any tool scope restrictions such as permissions or allowed-tools. In an agent environment, missing scope declarations can allow broader-than-expected command execution or make review and policy enforcement harder, increasing the chance of misuse of file paths and key material.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example generates a private key and writes it to disk using NoEncryption(), which stores the key unprotected at rest. Even though this is presented as a testing example, readers may reuse it in real workflows, and compromise of the PEM file would allow unauthorized signing of artifacts and undermine trust in distributed binaries.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 3. Use the sign_artifact.py script print("Running sign_artifact.py...") script_path = os.path.join("scripts", "sign_artifact.py") result = subprocess.run( ["python", script_path, "test_artifact.txt", "test_private.pem"], capture_output=True, text=True )