T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/network-tools.sh:180- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery Against Internal Resources
- Content
View full analysis
- Remediation
View remediation
Security audit
Network Tools
Security checks for vulnerabilities and agentic risk
Overview
This is a real network toolkit, but it gives agents broad web, proxy, and download power without enough destination or file-write safeguards.
Review this carefully before installing. Use it only for explicit, user-approved network requests; avoid internal URLs, metadata endpoints, and untrusted redirects; do not pass secrets in command-line headers; and keep downloads in a controlled directory after checking file names and content.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The changelog explicitly advertises 'anti-detection' user-agent rotation, which is a capability commonly used to evade rate limits, bot detection, or site access controls. Even though this is documentation rather than executable code, it signals the skill is designed to facilitate stealthier network interactions without warning users about legal, policy, or privacy implications, increasing misuse risk in a network-tools context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README promotes broad network fetch, download, proxy, and media retrieval capabilities but does not prominently warn that using the skill will transmit user-supplied data to external systems and may expose IP address, headers, or access patterns. In an agent context, this omission increases the risk of unintentional data exfiltration, privacy leakage, or unsafe use on untrusted URLs because operators may assume the tool is purely local and low risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documents custom output paths and download/media functionality without clearly warning that these operations write data to the local filesystem. In an agent setting, this can lead to unintended persistence of untrusted remote content, overwriting files, or placement of data in sensitive locations if output paths are user-controlled or loosely validated.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Basic Operations
bash # Simple fetch with auto tool selection network-tools fetch https://api.github.com/users/octocat # Force proxy usage for restricted content network-tools fetch --proxy https://blocked-api.com/data
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill permits arbitrary Authorization headers and even gives an example with a bearer token, but does not clearly warn that these credentials will be transmitted to remote services and may be exposed through logs, proxies, redirects, shell history, or misaddressed requests. In a networking skill with proxy support and broad tool selection, this materially raises the risk of credential leakage or exfiltration.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This example combines external transmission with an Authorization bearer token, demonstrating credentialed requests to a remote host. Because the skill does not pair this capability with strong warnings or secret-handling safeguards, it creates a realistic path for accidental secret disclosure to third parties or through tooling side effects such as logs and proxying.
- Content
network-tools download --tool=aria2 https://mirror.example.com/ubuntu.iso
Custom headers for authentication or API keys
network-tools fetch --header="Authorization: Bearer token123" https://api.example.com/protected
text ### Network Diagnostics
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill's invocation guidance recommends use for broadly defined 'external data retrieval,' 'file downloads,' and 'API integration,' which can cause an agent to select it for many generic tasks involving the internet. In a skill that performs live network access and local file writes, overly broad triggering increases the chance of unnecessary external transmission, unsafe downloads, and use in contexts where tighter user confirmation should be required.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
In the absence of a manifest, this file presents itself as a network tools skill, with fetch/download/diagnostic operations as its core purpose. The additional
mediacommand invokesyoutube-dlto download content from supported sites, which is a distinct content-acquisition capability not obviously required for basic network diagnostics or HTTP fetch tooling.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code invokes youtube-dl to download media, which will save files to the local filesystem, but there is no confirmation prompt or user-facing warning at the point of execution. The help text describes the feature but does not explicitly warn that running this command will create local files and consume disk space.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The help text advertises
fetch [--proxy] [--tool TOOL] [--header HEADER] URLandhandle_fetchparses--headerinto aheadersarray, implying caller-supplied headers will be sent. However, neitherhandle_fetchnorfetch_with_toolever passesheadersto curl, wget, or httpie, so the documented behavior is not implemented.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md traceroute, mtr, whois, youtube-dl, ffmpeg Examples: network-tools fetch https://api.example.com/data network-tools download --proxy -o large-file.zip https://example.com/file.zip network-tools dns --type MX google.com network-tools ipinfo --proxy
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh traceroute, mtr, whois, youtube-dl, ffmpeg Examples: network-tools fetch https://api.example.com/data network-tools download --proxy -o large-file.zip https://example.com/file.zip network-tools dns --type MX google.com network-tools ipinfo --proxy
Static analysis
No suspicious patterns detected.