T09 · Insecure Skill Coding Practices
Warning
- Location
query.sh:4- Finding
Database Credentials Are Intended to Be Stored in Plaintext Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Stripe
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to query Stripe billing data, but it uses an unrestricted SQL wrapper with plaintext credential setup, so it needs careful review before installation.
Install only if you are comfortable giving the agent SQL access to a synced Stripe billing database. Use a dedicated read-only PostgreSQL role restricted to the needed Stripe views, avoid putting credentials directly in query.sh, rotate any credentials that were stored or shared this way, and review queries before execution because the script does not prevent non-Stripe or mutating SQL.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims to query Stripe-related data from a synced PostgreSQL database, but its documented behavior is to pass arbitrary SQL to a shell script via exec. That creates a broader capability than advertised: the agent can potentially read or manipulate any accessible database objects, and user input could be transformed into unrestricted SQL execution against sensitive financial and customer data.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script takes an arbitrary SQL string from the caller and passes it directly to psql against a live remote database. Although the skill is described as limited to Stripe customer and billing lookups, this implementation enables unrestricted database operations within the connected account's privileges, which can expose unrelated data or permit destructive queries if the credentials are mis-scoped.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to modify a script with a database username and password, encouraging hardcoded credentials in a local file. This increases the risk of accidental exposure through version control, shell history, backups, logs, or file sharing, especially because the database contains Stripe customer and billing data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly exposes access to Stripe customer and billing records, which commonly include sensitive personal and financial data, yet provides no warning, consent boundary, minimization guidance, or handling restrictions. In an agent context, that increases the risk of over-collection, inappropriate disclosure, or casual querying of regulated data without user awareness.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The usage contract advertises a generic SQL_QUERY argument and even provides a broad example of selecting from users, indicating the skill is intentionally implemented as a general-purpose database client rather than a narrowly scoped Stripe lookup tool. In this context, that scope mismatch is dangerous because users or downstream agents may assume Stripe-only access while the skill actually permits broader database interrogation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script silently connects to an external hosted PostgreSQL instance and executes the provided query using embedded credential placeholders, with no runtime disclosure to the user that their prompt results in a networked database access. This increases the risk of unintended sensitive data access or exfiltration, especially in an agent setting where users may not realize a remote billing database is being queried.
- Content
Static analysis
No suspicious patterns detected.