Digital Labour

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:12 AM UTC
• Version: 1.0.0

Overview

This is a disclosed command-line wrapper for a remote AI business automation API, with no local persistence or hidden execution, but users should treat submitted business data as leaving their machine.

Install only if you are comfortable sending prompts, documents, customer records, CRM-like data, transaction text, and generated pipeline outputs to the configured Digital Labour remote service and its listed LLM providers. Keep DIGITAL_LABOUR_API_URL pointed at the trusted HTTPS production endpoint unless you deliberately use another endpoint, and avoid setting DIGITAL_LABOUR_API_KEY in environments where other users or scripts can alter the API URL.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dl-api.py:15

Finding

Unrestricted API Endpoint Configuration Can Expose Credentials and Sensitive Payloads

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tainted flow: 'req' from os.environ.get (line 65, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination is derived from the DIGITAL_LABOUR_API_URL environment variable and then used directly in urllib.request.urlopen. If an attacker can influence the runtime environment, they can redirect this client to an arbitrary host and cause API requests, including the X-Api-Key header, to be sent to an attacker-controlled endpoint, creating SSRF/exfiltration risk.

Content

Scanner excerpt · scripts/dl-api.py (reported line 50)May include surrounding context.

python

url = f"{BASE_URL}{path}"
    req = urllib.request.Request(url, headers=_headers(), method="GET")
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")

Tainted flow: 'req' from os.environ.get (line 65, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The POST target is built from an environment-controlled base URL and invoked with urllib.request.urlopen, while authentication headers are added automatically. An attacker who can set DIGITAL_LABOUR_API_URL can redirect agent runs and batch payloads to an arbitrary server, potentially leaking the API key and sensitive business inputs submitted to the tool.

Content

Scanner excerpt · scripts/dl-api.py (reported line 67)May include surrounding context.

python

data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=_headers(), method="POST")
    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")

Tainted flow: 'req' from os.environ.get (line 40, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The script builds its destination URL from the DIGITAL_LABOUR_API_URL environment variable and then sends requests, including the X-Api-Key header and user workflow data, to that endpoint. Because the endpoint is fully overrideable by environment without validation or allowlisting, a local attacker, poisoned runtime environment, or malicious wrapper script could redirect sensitive data and credentials to an attacker-controlled server.

Content

Scanner excerpt · scripts/dl-pipeline.py (reported line 42)May include surrounding context.

python

data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=_headers(), method="POST")
    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", errors="replace")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and depends on capabilities that read environment variables, access files, and make network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens user understanding and platform enforcement, making it easier for a skill handling business data to perform broader actions than a user may reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill routes user prompts and business data to a remote production API, and the API in turn uses multiple third-party LLM providers, but the documentation does not prominently warn users about that external data transfer. This creates a real privacy and compliance risk because users may submit proprietary, customer, financial, or personal data under the assumption that processing is local or limited to one provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples explicitly encourage submission of sensitive categories such as support tickets, contact information, transaction data, invoices, resumes, CRM records, and business plans, yet they provide no privacy, consent, or data-minimization warning. In this context, the omission is more dangerous because the skill is marketed for back-office automation, where users are likely to paste real customer, employee, and financial data into a multi-provider remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The pipeline collects user-provided inputs and transmits them to a remote third-party API, but the CLI does not clearly warn users that their data will leave the local machine. In a business automation skill handling client docs, lead data, proposals, or market research, this creates a real privacy and compliance risk if operators assume processing is local.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON manifest contains high-level descriptions such as "Full pipeline" and shorthand sequences like "Research → blog → repurpose → social → ads" that describe broad business tasks without specifying narrow activation conditions or exclusions. In a manifest file, this can create unclear trigger scope and increase the chance of unintended invocation for common requests related to sales, content, onboarding, or launches.

Content

No source excerpt is available for this finding.