T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/skillpay-charge.mjs:11- Finding
Configurable billing endpoint permits disclosure of billing credentials and user identifiers
- Content
View full analysis
- Remediation
View remediation
Security audit
File Memory Copilot
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a file-memory workflow, but it also attempts automatic paid billing through a network script before each use.
Review this skill before installing. It will create persistent task and memory files, and it instructs the agent to attempt a paid SkillPay charge before each invocation using a billing API key and user identifier. Only use it if you expect that billing behavior, trust the billing endpoint configuration, and are comfortable with task context being written to local files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The billing instructions require sending a user identifier to an external service and potentially charging before the skill proceeds, yet the user-facing description does not clearly warn about this behavior. This is dangerous because it combines financial action and data transmission without explicit informed consent, which can lead to privacy violations, surprise charges, and abuse of external API access.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This script adds a payment-charging capability to a skill described as file-based memory and archival management, which is a strong scope mismatch. In an agent environment, unrelated billing logic can enable unauthorized monetization or surprise charges, especially when invoked implicitly as part of a workflow the user would not expect to incur costs.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code posts charge requests to a remote billing endpoint using environment-provided API credentials and a user identifier, despite no clear relation to archival or memory functions. Because this capability is networked and financially impactful, embedding it in an unrelated skill increases the risk of covert or accidental charges and makes the skill context materially more dangerous.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares runtime capabilities that include environment access and outbound network use via billing, but it does not declare a corresponding tool scope or permission boundary. This creates a transparency and policy gap: users and the host may not realize the skill can access secrets and contact external services, increasing the chance of unintended data exposure or unauthorized actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation conditions use broad conversational phrases such as clearing context or creating markdown archives, which can easily appear in ordinary discussion. This raises the risk of accidental activation, causing unintended file creation, persistent data retention, or billing/network actions when the user did not mean to invoke the skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest presents the skill as a local file-memory and archival workflow, but the instructions add mandatory pre-execution billing through an external API. That mismatch is dangerous because users may invoke a seemingly local persistence skill without understanding that identifiers and billing metadata will be transmitted off-system before any work occurs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Charging an external billing endpoint is not inherent to creating task archives or memory files, so the network behavior is not justified by the stated purpose. Unnecessary external connectivity expands the attack surface, enables data transmission unrelated to the user’s task, and can facilitate monetization or tracking without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow mandates creating and updating multiple repository and workspace files, including long-term memory artifacts, without a clear upfront warning that persistent data will be written. In practice this can modify project state, leak sensitive task context into tracked files, and create durable records the user did not intend to store.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script transmits billing-related identifiers such as user_id and skill_id to an external API without any user-facing notice, consent, or confirmation flow in the code path. Even if the identifiers are not highly sensitive alone, sending them during a charge operation without transparency can facilitate unauthorized billing attempts and unnecessary disclosure of account-linked metadata.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The natural-language content directs behavior entirely in Chinese, which may impose a language expectation on users or operators without opt-in. The file does not indicate that the skill is intentionally region-specific or offer an alternative language choice.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/skillpay-charge.mjs:12