T09 · Insecure Skill Coding Practices
Error
- Location
index.js:58- Finding
Caller-Controlled Output Path Allows Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Brouter
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent route-generation purpose, but it writes caller-directed files, sends precise route data over plain HTTP, and keeps undisclosed local logs of location details.
Review before installing. This skill sends route coordinates to brouter.de using plain HTTP and saves GPX files locally. It also logs detailed route and path information, and its output path controls should be tightened so it can only write inside a dedicated routes directory.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
index.js:76- Finding
Route Coordinates and GPX Responses Are Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
index.js:55- Finding
Persistent Logging Exposes Complete Invocation Options and Location Data
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
package.json:4- Finding
Unpinned Dependencies and Missing Lockfile Make Installations Non-Reproducible
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose understates important behaviors: the skill writes persistent route/log files, depends on pre-geocoded coordinates, and stores output locally. This mismatch can mislead users and reviewers about data handling, especially when route endpoints may reveal sensitive location information.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Parse all location data to coordinates before using `index.js`. Never use free-text descriptions of locations directly as input for `index.js`. Use coordinates
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Parse all location data to coordinates before using `index.js`. Never use free-text descriptions of locations directly as input for `index.js`. Use coordinates
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Parse all location data to coordinates before using `index.js`. Never use free-text descriptions of locations directly as input for `index.js`. Use coordinates
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Parse all location data to coordinates before using `index.js`. Never use free-text descriptions of locations directly as input for `index.js`. Use coordinates
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The caller can fully control outputDir and fileName, and the code resolves and writes the resulting path without constraining it to a safe base directory. This turns the skill into a general arbitrary file writer, allowing overwrite or creation of files outside the intended routes directory if an attacker can influence inputs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes a networked routing service but does not declare any tool scope or permissions in the manifest. That creates a transparency and policy-enforcement gap: agents or users may not realize the skill sends data externally, and platforms cannot easily constrain or review that capability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to send origin and destination data to brouter.de without informing the user that their route endpoints will be shared with a third party. Location data is often sensitive, so undisclosed transmission creates a meaningful privacy risk even if the service itself is legitimate.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill persistently writes operational data to local disk, including a dedicated log file and generated GPX content. While file output for a GPX-producing skill is partly expected, the persistent logging extends data retention beyond the narrowly described purpose and can expose sensitive route/location information to other local users or later processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill logs the full options object at invocation and later records request/response context, which can include route coordinates, labels, filenames, and paths. Persisting this information without user awareness creates unnecessary local privacy exposure and long-term retention of sensitive movement/location data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill sends precise route coordinates to an external service over plain HTTP, not HTTPS, with no user disclosure. This creates both a privacy issue and a transport-security issue: location data can be observed or modified in transit by network attackers.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instructions tell the agent to run the implementation and return a file from the routes folder without warning that route artifacts are written to local disk. Silent persistence of user route data can expose travel patterns to later processes, users, or logs on the same system.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The inline documentation says callers must provide coordinates and use a separate geocoding step, while the manifest describes use for routes between two places. That is an intent-level discrepancy because the documentation narrows supported input semantics compared with the advertised behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill creates directories and writes the fetched GPX route to a local file, which affects user data on disk. The code documents this behavior for developers, but it does not provide a user-facing disclosure or confirmation about file creation and storage location.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency version for node-fetch is specified with a caret range (^2), which allows different 2.x releases to be installed over time. This weakens build reproducibility and can unexpectedly pull in vulnerable or behavior-changing versions, especially relevant here because node-fetch has known advisories in some 2.x releases.
- Content
json "name": "brouter", "main": "index.js", "dependencies": { "node-fetch": "^2", "gpx-parse": "^0.10.1" } }
Unverifiable Dependency: node-fetch has 3 known advisory(ies) (CVE-2022-0235 (node-fetch forwards secure headers to untrusted sites); CVE-2022-2596 (node-fetch Inefficient Regular Expression Complexity ); CVE-2020-15168 (The `size` option isn't honored after following a redirect in node-fetch)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The manifest uses an unpinned node-fetch dependency while that package has known published advisories affecting some versions. Because the exact installed release is not fixed, consumers of the skill may unknowingly install an affected version, which is particularly relevant in a skill that performs network requests to generate routes.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 85% confidence
- Finding
The dependency gpx-parse is also specified with a caret range (^0.10.1), allowing non-deterministic installs within the permitted range. This creates supply-chain and reproducibility risk because future installs may resolve to different code than what was originally tested.
- Content
json "main": "index.js", "dependencies": { "node-fetch": "^2", "gpx-parse": "^0.10.1" } }
Static analysis
No suspicious patterns detected.