T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/confluence.py:24- Finding
Confluence API Credentials Can Be Sent to an Unvalidated Network Destination
- Content
View full analysis
- Remediation
View remediation
Security audit
Snowsand Confluence
Security checks for vulnerabilities and agentic risk
Overview
This is a real Confluence management skill, but it gives broad live workspace authority with weak safeguards around API tokens, permanent deletes, and downloads.
Review before installing. Use a narrowly scoped Atlassian API token, verify CONFLUENCE_BASE_URL is exactly your HTTPS Confluence tenant, avoid raw curl workflows unless needed, require explicit human confirmation before delete or purge commands, and use an explicit safe output path when downloading attachments.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tainted flow: 'req' from os.environ.get (line 463, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = Request(url, data=body, headers=headers, method=method) try: with urlopen(req) as resp: content = resp.read().decode() return json.loads(content) if content else {} except HTTPError as e:
Tainted flow: 'req' from os.environ.get (line 463, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = Request(url, data=body, headers=headers, method=method) try: with urlopen(req) as resp: content = resp.read().decode() return json.loads(content) if content else {} except HTTPError as e:
Tainted flow: 'req' from os.environ.get (line 463, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The download path is taken from untrusted remote metadata: if --output is not provided, the code writes the downloaded attachment to att.get("title"), which is attacker-controlled attachment/page content in Confluence. A crafted attachment title containing path traversal sequences or an absolute path could cause arbitrary file overwrite in the local filesystem where the skill runs.
- Content
python req = Request(url, headers=headers) try: with urlopen(req) as resp: output_path = args.output or att.get("title", "attachment") with open(output_path, "wb") as f: f.write(resp.read())
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md All operations use the `scripts/confluence.py` script:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents use of environment variables and direct network access to Confluence, but it does not declare any tool scope such as permissions or allowed-tools. In an agent environment, this weakens least-privilege controls and can allow unintended access to credentials or outbound requests if the skill is invoked unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger description is extremely broad, covering essentially any Confluence or documentation-related task. This increases the chance the skill is auto-selected in situations the user did not intend, which is especially risky because the skill includes write and delete operations against a live SaaS workspace.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation shows page deletion and permanent purge commands without strong warnings, confirmation requirements, or rollback guidance. In a skill that can act on production documentation, omission of safety prompts materially raises the risk of accidental destructive actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The attachment deletion examples include permanent purge operations without cautionary language or approval requirements. Because attachments may contain important records or artifacts, presenting purge as a normal workflow can lead to irreversible loss.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "$CONFLUENCE_BASE_URL/wiki/rest/api/content?type=page&limit=5" | jq . # POST with body curl -s -X POST -u "$CONFLUENCE_USER_EMAIL:$CONFLUENCE_API_TOKEN" \ -H "Content-Type: application/json" \ -d '{"spaceId":"12345","title":"Test","body":{"representation":"storage","value":"<p>Hello</p>"}}' \ "$CONFLUENCE_BASE_URL/wiki/api/v2/pages" | jq .
Static analysis
No suspicious patterns detected.