T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:219- Finding
Overbroad Git staging and destructive preview branch force-push
- Content
View full analysis
- Remediation
View remediation
Security audit
Blog Publisher
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent blog-publishing workflow, but it uses broad Git publishing commands and under-disclosed external image-generation behavior that users should review before installing.
Install only if you are comfortable letting the agent modify and push the dev-blog repository. Before use, replace git add -A with explicit file paths, review the staged diff, avoid force-push or use force-with-lease only with confirmation, and require a clean working tree. Treat image prompts and Telegram-transferred files as shared with third parties, avoid secrets or sensitive drafts in prompts, strip image metadata when needed, and use restricted provider API keys.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/generate-image.py:65- Finding
Google API credential embedded in the request URL
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (14)
Tainted flow: 'req' from os.environ.get (line 110, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"}) try: with urllib.request.urlopen(req, timeout=180) as resp: data = json.loads(resp.read()) except Exception as e: print(f"ERROR: Google API call failed: {e}", file=sys.stderr)
Tainted flow: 'req' from os.environ.get (line 110, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"}) try: with urllib.request.urlopen(req, timeout=180) as resp: data = json.loads(resp.read()) except Exception as e: print(f"ERROR: Google API call failed: {e}", file=sys.stderr)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
설명은 블로그 발행 파이프라인과 이미지 프롬프트 제공/후처리를 말하지만, 실제 코드 조각은 블로그 발행이나 문서 변환, 배포 승인 흐름을 다루지 않는다. 대신 Google AI Studio 또는 OpenRouter에 직접 요청을 보내 AI 이미지를 생성하는 기능이 핵심이다. 특히 '사용자가 직접 생성한 이미지 후처리'와 달리 이 코드는 이미지를 생성한다는 점이 materially different primary purpose에 해당한다. 또한 외부 API 키를 읽고 원격 서비스에 요청하는 능력은 설명에 드러나지 않는다. 따라서 설명과 실제 동작은 불일치한다.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
Using
git push origin preview --forceallows the skill to overwrite remote branch history unconditionally. In an automated workflow, this can destroy collaborators' work, erase audit history on the preview branch, and make recovery difficult if the agent operates on stale or incorrect state.- Content
git checkout -B preview git add -A git commit -m "Add blog post: {title}" git push origin preview --force
text 확인 링크:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python import urllib.request from pathlib import Path # Load .env from skill directory env_path = Path(__file__).parent.parent / ".env" if env_path.exists(): with open(env_path) as f:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path # Load .env from skill directory env_path = Path(__file__).parent.parent / ".env" if env_path.exists(): with open(env_path) as f: for line in f:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill describes operations that require filesystem, environment, git, and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This increases the chance an agent will run with broader capabilities than intended, making unintended repository modification, credential exposure, or outbound actions harder to constrain and audit.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs users to transmit generated images through Telegram without warning about third-party handling, retention, or the possibility that images may contain sensitive information or metadata. This can lead to privacy leakage, especially if screenshots, drafts, or embedded EXIF/location data are shared through an external messaging platform.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest describes publishing blog content, converting Markdown, and handling user-generated images, but this script proactively loads secrets from a local .env file into the process environment. While networked image generation itself is documented, custom credential harvesting from local files is a broader capability than the manifest states and is not obviously required by the declared skill purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script transmits user-supplied prompts to external AI services without any explicit consent prompt, privacy notice, or warning that prompt contents leave the local environment. In a blog-publishing workflow, prompts may contain unpublished drafts, proprietary ideas, or personal data, so silent transmission increases confidentiality and compliance risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instructions say to write a detailed English prompt for image generation, which imposes a language choice in the workflow. Because the file does not offer user opt-in or explain that English is required for a specific tool limitation, this is a natural-language locale policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown states that text inside images should preferably be in English, which is a locale/language preference expressed as a rule. This can conflict with the policy against forcing a specific language unless users are given a choice or the constraint is clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script's primary natural-language documentation and several comments are written in Korean, while the tool itself does not offer any language selection or document a locale-specific constraint. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module usage comment states that Google AI Studio is the default provider, but the actual default is taken from IMAGE_PROVIDER with a fallback of "openrouter". This is an active contradiction between the script documentation and runtime behavior, which can mislead operators about which external service receives prompts by default.
- Content
Static analysis
No suspicious patterns detected.