T09 · Insecure Skill Coding Practices
Error
- Location
config.json:1- Finding
Plaintext API Credential Packaged in Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Agnes Vision
Security checks for vulnerabilities and agentic risk
Overview
The skill has a clear image-analysis purpose, but it ships a plaintext API key and can send images plus credentials to a configurable endpoint.
Review before installing. Only use this with images you are comfortable uploading to a third-party service, remove the packaged config.json key, rotate that exposed credential, and avoid custom endpoints unless they are explicitly trusted and use HTTPS.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
agnes_vision.py:77- Finding
Arbitrary Endpoint Selection Forwards API Credentials and Image Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The script performs outbound network requests to a remote endpoint and uploads user-provided image data, but the capability is not covered by declared permissions. In a permissioned skill framework this is a real security issue because it bypasses transparency and prevents users or the platform from making an informed trust decision about remote data exfiltration.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The script performs outbound network requests to a remote endpoint and uploads user-provided image data, but the capability is not covered by declared permissions. In a permissioned skill framework this is a real security issue because it bypasses transparency and prevents users or the platform from making an informed trust decision about remote data exfiltration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code base64-encodes local images and sends them to a third-party API endpoint without any explicit runtime warning or consent flow. This can leak sensitive visual data, embedded personal information, documents, screenshots, or metadata-bearing content to an external provider, especially if users assume processing is local.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language instructions, defaults, and user-facing messages are all in Chinese, including the default prompt requesting a Chinese description, with no indication that the user can select another language. This can violate a language/locale policy when a skill imposes one language without opt-in.
- Content