Security audit

Data Pipeline Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ETL guide, but its sample API extractor can forward authorization headers to unvalidated pagination URLs while handling financial/business data.

Review before installing or using this skill for real credentials. Harden the API extractor to restrict pagination to the original trusted HTTPS host, add timeouts and page limits, load secrets from environment variables or 1Password CLI, pin dependencies in an isolated environment, and ensure any Telegram alerts contain only sanitized status text.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:55
Finding: Authorization Header Leakage Through Unvalidated Pagination URLs
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:288
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest says the skill is not for raw SQL query writing, and the safety rules state extraction is read-only by default. Yet the QBO example embeds a free-form query string (SELECT * FROM Invoice) directly in the request URL, demonstrating raw query composition against a source system rather than a constrained extractor pattern. This contradicts the documented boundary around avoiding raw query writing.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The checklist and safety rules explicitly require secrets to be stored in environment variables rather than hardcoded. However, the example code defines HEADERS = {"Authorization": "Bearer <TOKEN>"...}, normalizing an in-code credential pattern that conflicts with the stated guidance. Even as a placeholder, the documented example contradicts the declared secure usage model.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs users to send completion or failure notifications to Telegram without warning that operational details, paths, timestamps, pipeline names, or error content may be transmitted to a third-party service. In an ETL context handling financial and business data, even status metadata can reveal sensitive internal operations or be expanded later to include logs and customer information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.