T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:26- Finding
Overly Broad curl Permission Enables Unrestricted Network Requests and Potential Local Data Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
deep-research
Security checks for vulnerabilities and agentic risk
Overview
This research skill is not malicious, but it requests broad web, file-writing, sub-agent, and unrestricted curl capabilities that should be reviewed before installation.
Install only if you are comfortable with a skill that can run broad web research, spawn multiple sub-agents, write reports under ./research, and invoke curl with arbitrary arguments. Prefer using it in a sandboxed workspace without secrets, and consider removing or restricting curl and pinning md-to-pdf before routine use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:22- Finding
Unpinned Executable Node Dependency Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger description is extremely broad and includes many casual phrasings such as 'look into X' and 'what's the deal with Y', which can cause the skill to activate for loosely related requests. Because this skill has web access, file write capability, agent spawning, and shell access to selected commands, unintended invocation can lead to unnecessary external requests, report generation, and wider tool use than the user likely expected.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- <!-- Steps 2–4: findings are appended here as sub-agents complete. Do not leave this comment in the final report. --> <!-- TYPE: market -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- END TYPE: domain --> <!-- TYPE: technical --> ## Technology Landscape
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- END TYPE: product --> <!-- TYPE: academic --> ## Literature Overview
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description emphasizes research capabilities but does not clearly warn users that the skill may perform extensive web searches, fetch many pages in parallel, and write reports to disk automatically. This weakens informed consent and increases the chance that users invoke the skill without realizing it will create local artifacts and transmit prompts or derived queries to external services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file defines when to use the skill using very broad language such as "type == community" and an open-ended probe covering "something else." The scope is intentionally broad and does not provide exclusion conditions or negative examples, which increases the chance of triggering on common research requests that only loosely relate to communities.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown file instructs the agent to append findings to an output file as sub-agents complete, which is a data-affecting behavior. The description does not include any warning that the skill will modify files or incrementally write results, so users may not realize their report/output file will be changed during execution.
- Content
Static analysis
No suspicious patterns detected.