T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:118- Finding
API Credential Exposed Through Background Poller Process Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Agentline.cloud
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent telephony integration, but it asks the agent to run an unbounded background poller, handle sensitive calls and texts, and make permanent billable purchases without enough user control.
Install only if you are comfortable giving the agent access to AgentLine calls, transcripts, inbound SMS, billing details, and number provisioning. Before use, require explicit confirmation for every outbound call and number purchase, avoid running the provided background poller, and keep AGENTLINE_API_KEY out of command-line arguments or logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
SKILL.md:27- Finding
Billable and Permanent Number Provisioning Without Explicit Purchase Confirmation
- Content
View full analysis
"What area code would you like for your phone number? (e.g. 212 for NYC, 415 for SF, 313 for Detroit)" - Once they give an area code, call `POST /v1/numbers` with `{"agent_id": "...", "area_code": "XXX"}` - If it succeeds, confirm the provisioned number to the human - If it fails (no numbers available for that area code), tell them and ask for a different area code ``` The operation is separately documented as billable: ```markdown ## Phone Numbers Each agent needs one phone number. Only US numbers supported. **$2.00 per number.** ### Provision (Buy) a Number `POST /v1/numbers` with: ``` The rules also state that the purchased resource cannot be released: ```markdown 6. **Don't release numbers** — numbers are permanent once provisioned. ``` ### Technical Analysis The setup workflow interprets the user's selection of an area code as authorization to immediately invoke the number-purchasing endpoint. It does not require the agent to disclose the exact price and permanence of the number immediately before the transaction, nor does it require an explicit confirmation that the user intends to incur the charge. An area-code response is configuration input and is not necessarily informed financial consent. The workflow confirms the number only after provisioning succeeds, at which point the documented one-time charge has already occurred and the number is described as permanent. No instruction requires checking for an existing number before provisioning. Consequently, repeated or restarted setup flows may also create a risk of duplicate purchases. ### Attack Path 1. The setup workflow asks the user w ...[truncated 1066 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description does not prominently warn that the skill can read inbound SMS contents and full call transcripts, both of which are highly sensitive communications data. Without an upfront privacy disclosure, users may invoke the skill for benign telephony tasks without realizing it can surface private message and call content.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **List voices:** `GET /v1/voices` - **Set account default:** `PATCH /v1/account/voice` with `{"voice_id": "female-1"}` - **Check current:** `GET /v1/account/voice` - **Reset to default:** `DELETE /v1/account/voice` ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation description is broad enough to match common user requests about calls, texts, agents, and billing without sharply limiting when the skill should activate. In context, this matters because the skill can place calls, access message history, provision paid phone numbers, and expose transcripts, so over-broad triggering can lead to unnecessary access to sensitive data or costly actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to write and launch a persistent background polling process on the host, which extends behavior from API use into local code execution and process persistence. That is dangerous because it can create unauthorized long-running activity, increase attack surface on the local system, and normalize terminal use unrelated to the minimum telephony actions needed to satisfy user requests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Make an Outbound Call
bash curl -X POST $AGENTLINE_URL/v1/calls \ -H "Authorization: Bearer $AGENTLINE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"agent_id": "$AGENTLINE_AGENT_ID", "to_number": "+1XXXXXXXXXX", "system_prompt": "...", "initial_greeting": "...", "voice_id": "female-1"}'
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Embedding Bash and PowerShell polling scripts in the skill materially encourages local script execution on multiple operating systems. Even though the scripts target the vendor API, including executable OS-specific code inside a skill broadens the skill from API orchestration into host automation, which can be abused or adapted to perform unintended actions.
- Content
Static analysis
No suspicious patterns detected.