T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:77- Finding
Bearer API Key Embedded in MCP Endpoint URL
- Content
View full analysis
- Remediation
View remediation
Security audit
SanctifAI Source
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent, but it needs review because it can send task content and files to third-party human workers and documents bearer API keys in MCP URLs.
Review this before installing. Use it only for content you are willing to send to SanctifAI and, depending on routing, external human workers. Avoid public routing for confidential, personal, regulated, or credential-bearing material; require explicit approval before creating tasks, uploading files, sharing links, inviting users, sending billing invites, or minting another agent key. Treat any MCP URL containing access_token as a secret and prefer header-based or secret-manager authentication when possible.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:677- Finding
Public Human-Task Submission Lacks Mandatory Sensitive-Data and Consent Controls
- Content
View full analysis
" }) ``` ```http POST /v1/tasks/{task_id}/attachments Authorization: Bearer sk_live_xxx Content-Type: application/json { "file_name": "q1-report.pdf", "mime_type": "application/pdf", "content_base64": "" } ``` ### Technical Analysis External transmission ...[truncated 3353 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # SanctifAI: Human-in-the-Loop for AI Agents <!-- Canonical public URL: https://app.sanctifai.com/agents/source/skill.md (aliases: /source-skill.md, /agents/skill.md, /skill.md; HTML: /agents/skill) --> > **Base URL:** `https://app.sanctifai.com/v1`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation repeatedly instructs agents to send task content, forms, attachments, and links to human workers, but it does not prominently warn that any included data will be disclosed outside the originating system. This omission can cause agents to exfiltrate sensitive prompts, internal documents, credentials, personal data, or confidential business context to third-party humans.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is presented as a human-review/task-completion integration, but it also exposes agent provisioning, org invites, billing invites, API key minting, and broader administration workflows. This capability expansion increases the blast radius if an agent follows the skill naively, because a caller expecting only HITL review could end up creating new credentials, inviting third parties, or initiating billing/admin actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples encourage embedding and attaching external URLs for workers to open, but they do not clearly warn that link access controls, tokenized URLs, and sensitive shared documents may expose confidential data to workers or leak access if links are overshared. Because the system stores URLs and presents them to humans, careless use can disclose private documents or internal resources unintentionally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The documented workflow explicitly sends task payloads to an external service for human completion, which is a real external-transmission behavior rather than a local-only skill. In this context, the danger is not the API call itself but that agents may forward sensitive content to a third-party platform and ultimately to human workers without sufficient review.
- Content
md # Pick: task_type="EVA", domain="GEN", use_case="verification" # Step 2: Create a research verification task task = requests.post(f"{BASE_URL}/tasks", headers=headers, json={ "name": "Verify Research Finding", "summary": "Confirm this statistic before publishing", "target_type": "public",
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The worker and guild discovery sections provide broad search, profiling, reputation, geography, language, certification, and rate-based routing features that exceed a minimal approval/escalation workflow. Even if intended for matchmaking, these capabilities enable more expansive data access and autonomous actor-selection than a basic HITL skill, increasing privacy and misuse risk.
- Content