T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:34
- Finding
- Hard-Coded Discord Destination May Disclose Agent Activity## Vulnerability Details **File Location**: `SKILL.md`, lines 34–42; related guidance at lines 44–54 **Vulnerability Type**: Hard-coded external destination and uncontrolled disclosure of task metadata **Risk Level**: Medium ### Vulnerable Code ```javascript // Send activity update message({ action: "send", channel: "discord", to: "channel:1477516155655688306", message: "⏳ **Activity Update**\n\nInstalling 6 skills... (waiting for rate limit)" }) ``` Related instructions encourage including progress information and always transmitting a final summary: ```markdown ## Guidelines - **Be concise** — short updates, not novels - **Use emoji** — visual scanning is faster - **Include progress** — "3/6 installed" is better than "installing..." - **Don't spam** — only for tasks >5 seconds - **Final summary** — always send completion message ## Configuration Optional: Set `ACTIVITY_CHANNEL_ID` in environment to override default channel. ``` ### Technical Analysis The Skill instructs the Agent to transmit task status over Discord using a hard-coded channel ID, `1477516155655688306`. It does not require verification that this destination is controlled by or approved by the user. Although external messaging is necessary for the declared notification functionality, selecting a fixed external recipient is not necessary and violates the principle of least disclosure. Progress reports, error notices, and final summaries may expose operational metadata such as task names, installed components, execution progress, external services being accessed, or failure details. The instructions do not define content filtering or prohibit secrets, credentials, private file contents, prompt data, or sensitive error output from being included. The documented `ACTIVITY_CHANNEL_ID` override is optional and is not used by the example. Consequently, an Agent following the example may send information to the embedded channe ...[truncated 1415 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the hard-coded Discord channel ID from all examples and defaults. 2. Require a user-supplied, explicitly approved destination such as `ACTIVITY_CHANNEL_ID`; fail closed when it is absent. 3. Ask for confirmation before the first external notification, clearly identifying the destination channel. 4. Validate that the selected destination matches the approved configuration rather than accepting arbitrary channel identifiers from task content. 5. Restrict notifications to predefined status values and minimal, generic progress counters. 6. Prohibit transmission of credentials, tokens, prompts, private file contents, command output, stack traces, secret-bearing URLs, and detailed error payloads. 7. Redact sensitive values before invoking the `message` tool. 8. Make final summaries optional rather than mandatory and require separate consent before transmitting detailed summaries. 9. Document the external disclosure boundary and the intended Discord audience so users can assess channel membership and retention policies.