T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:37- Finding
API Credentials and Financial Data May Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
sure-finance-skill
Security checks for vulnerabilities and agentic risk
Overview
This is a real Sure finance API helper, but it has review-worthy risks around sending API keys over HTTP and optional Docker setup from mutable remote files.
Install only if you trust the Sure server and understand the skill can read and change financial records. Use an https:// SURE_BASE_URL except for explicit localhost development, require confirmation before imports or transaction changes, and treat the self-hosting Docker guide as privileged setup that should use pinned, verified files before running compose.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
docs/self-hosting-quickstart.md:12- Finding
Mutable Remote Compose Definitions Are Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
/compose.example.yml" printf '%s %s\n' "" "compose.yml" | sha256sum --check - # Inspect compose.yml before proceeding. docker compose -f compose.yml config docker compose -f compose.yml up -d ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This playbook performs CSV import into an account, which is a bulk data creation operation, yet it omits an explicit warning about the scope and permanence of the import. In financial systems, bulk imports are especially risky because a bad mapping, malformed dates, or wrong target account can create many incorrect records at once, causing widespread data integrity issues that are harder to unwind than a single edit.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md Do not request optional credentials in standard workflows. Use optional credentials only when the user explicitly opts into self-hosting or external-assistant checks. ## Output Rules - Prefer concise outputs for automation scenarios. - Avoid exposing secrets in logs, traces, and examples.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Optional Environment Hardening
bash curl -o .env https://raw.githubusercontent.com/we-promise/sure/main/.env.exampleRecommended values:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Validation check:
bash curl --silent --show-error --fail \ --request GET \ --url "$SURE_BASE_URL/api/v1/accounts?page=1&per_page=1" \ --header "X-Api-Key: $SURE_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This playbook instructs the agent to patch a transaction's category, which changes persisted financial data, but it does not require an explicit user-facing warning or confirmation before the write occurs. In a finance skill, silent modification of transaction metadata can misclassify spending, affect downstream budgets or reports, and cause unintended account record changes if the request is ambiguous or mistaken.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This playbook creates a new transaction and may subsequently modify its tags, but it does not state that new records will be created or that persistent metadata will be changed. In a personal finance context, unnoticed creation of transactions can corrupt ledgers, duplicate expenses, and skew balances, reports, and automations tied to tags or categorization.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash mkdir -p ~/docker-apps/sure cd ~/docker-apps/sure curl -o compose.yml https://raw.githubusercontent.com/we-promise/sure/main/compose.example.yml # Review compose.yml before proceeding docker compose up -d
Static analysis
No suspicious patterns detected.