T09 · Insecure Skill Coding Practices
Error
- Location
trustloop-check.js:29- Finding
Incomplete argument redaction can disclose credentials and confidential data
- Content
View full analysis
- Remediation
View remediation
Security audit
TrustLoop - Trust layer for AI Agents
Security checks for vulnerabilities and agentic risk
Overview
This is a plausible governance integration, but it needs Review because it sends potentially sensitive tool-call arguments to a third-party service while overstating privacy and enforcement guarantees.
Install only if you are comfortable using TrustLoop as a third-party advisory audit and policy-check service, not as a hard kill switch. Use a dedicated low-privilege API key, avoid sending secrets or full file/message contents in tool arguments, and verify TrustLoop's retention, log access, authorization, and fail-closed behavior before relying on it for sensitive workflows.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
trustloop-check.js:20- Finding
Fail-open error handling bypasses governance and kill-switch enforcement
- Content
View full analysis
{ let data = '' res.on('data', (chunk) => { data += chunk }) res.on('end', () => { try { const result = JSON.parse(data) process.stdout.write(JSON.stringify({ allowed: result.allowed !== false })) } catch (_) { process.stdout.write(JSON.stringify({ allowed: true, error: 'parse error — failing open' })) } }) }) req.on('error', () => { process.stdout.write(JSON.stringify({ allowed: true, error: 'network error — failing open' })) }) req.setTimeout(3000, () => { req.destroy() process.stdout.write(JSON.stringify({ allowed: true, error: 'timeout — failing open' })) }) ``` ### Technical Analysis The governance decision defaults to approval whenever the service cannot return the exact JSON value `{ "allowed": false }`. Specifically, the script permits the requested operation when: - `TRUSTLOOP_API_KEY` is absent. - A DNS, TLS, connection, or other network error occurs. - The request exceeds the three-second timeout. - The response is malformed or is not JSON. - The response omits the `allowed` property. - The response contains an unexpected value such as `null`, a string, or an object. - The server returns an error HTTP status with a parseable body that does not contain literal boolean `false`. The expression below treats every value except the exact boolean `false` as approval: ```javascript result.allowed !== false ``` The script also does not validate the HTTP status code or enforce a ...[truncated 1789 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is marketed as an enforcement and governance layer, but the file contains only advisory instructions telling the agent to call an external API before sensitive actions. Because there is no actual in-skill enforcement, logging, or kill-switch mechanism, operators may falsely rely on it as a security control and allow risky tool use under the mistaken belief that protections are active.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
The API provides a direct parameterized endpoint to unblock any tool by name, and the reference shows no indication of authorization constraints, approval workflow, allowlist, or safeguards around who may invoke it. In the context of a governance and kill-switch product, abuse of this endpoint could disable critical protections and re-enable dangerous tool actions, undermining the entire enforcement layer.
- Content
Unblock a Tool
text DELETE /api/blocked-tools/:tool_nameList Blocked Tools
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 78% confidence
- Finding
The skill requests access to an environment secret (
TRUSTLOOP_API_KEY) but does not declare an explicit tool/permission scope governing how that secret may be used. In practice, the skill instructs the agent to send data and the API key to a third-party service, so the lack of explicit scope and guardrails increases the chance of over-broad secret use and unnoticed exfiltration paths.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The skill directs the agent to transmit tool names and arguments to
api.trustloop.livebefore sensitive actions, which is an external data flow involving operational metadata and potentially sensitive arguments. Even though the text says to mask secrets and claims PII redaction, those are policy promises rather than enforceable guarantees, and users may still leak confidential file paths, recipients, business context, or incomplete secret material to a third party.- Content
Before calling any tool that is destructive, external, financial, or bulk in nature, check with TrustLoop:
bash curl -s -X POST https://api.trustloop.live/api/intercept \ -H "Content-Type: application/json" \ -H "x-api-key: $TRUSTLOOP_API_KEY" \ -d '{"tool_name": "<tool>", "arguments": <args_json>}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The skill directs the agent to transmit tool names and arguments to
api.trustloop.livebefore sensitive actions, which is an external data flow involving operational metadata and potentially sensitive arguments. Even though the text says to mask secrets and claims PII redaction, those are policy promises rather than enforceable guarantees, and users may still leak confidential file paths, recipients, business context, or incomplete secret material to a third party.- Content
Before calling any tool that is destructive, external, financial, or bulk in nature, check with TrustLoop:
bash curl -s -X POST https://api.trustloop.live/api/intercept \ -H "Content-Type: application/json" \ -H "x-api-key: $TRUSTLOOP_API_KEY" \ -d '{"tool_name": "<tool>", "arguments": <args_json>}'
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
text POST /api/blocked-tools { "tool_name": "delete_files", "reason": "Too risky without approval" }Unblock a Tool
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json ], "externalConnections": [ { "url": "https://api.trustloop.live/api/intercept", "purpose": "Check tool call against governance rules and kill-switches before execution. Returns allowed:true or allowed:false.", "dataTransmitted": "Tool name + arguments only (secrets auto-redacted by trustloop-check.js before transmission using pattern matching). No file contents, conversation history, system prompts, or credentials are ever sent." }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script reads TRUSTLOOP_API_KEY from the environment and sends it as an x-api-key header to an external service. Although this is functionally expected for an API client, it is still a real data-transfer risk because there is no explicit user disclosure/consent and the surrounding design uses a remote governance service in a security-sensitive interception path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script serializes tool arguments and transmits them to a remote endpoint, only attempting partial regex-based redaction first. This is dangerous because tool arguments can contain secrets, proprietary data, prompts, personal information, or file contents not matched by the limited patterns, resulting in silent exfiltration to a third party from a highly privileged agent context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The API reference exposes an audit-log endpoint that returns raw tool names, arguments, statuses, and timestamps, but it provides no warning about the sensitivity of logged arguments or any guidance on minimizing, masking, or restricting access to that data. In an agent setting, tool arguments can contain secrets, personal data, file paths, prompts, or operational activity history, so unauthorized or overbroad access to logs can become a meaningful confidentiality and surveillance risk.
- Content
Static analysis
No suspicious patterns detected.