T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scaffold_direct_client.py:67- Finding
Python Code Injection Through Untrusted HAR Header Values
- Content
View full analysis
- Remediation
View remediation
Security audit
Lockpicker
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent legitimate purpose, but it handles live browser-session credentials and includes helper scripts that can expose or unsafely generate code from sensitive HAR data.
Install only if you are comfortable giving the agent access to HAR files and live session credentials for accounts you control. Keep all HARs and generated auth files out of chat, source control, sync folders, logs, and shared workspaces; review generated Python before running it; and prefer restrictive local permissions and cleanup after use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract_cookie_headers.py:28- Finding
Live Authentication Credentials Written to Plaintext Files Without Permission Hardening
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract_har_requests.py:29- Finding
Sensitive HAR Request Bodies Exported and Printed Without Redaction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## Warnings - These values often grant live account access. - Reusing them may violate the service's terms. - The service may revoke, rotate, or challenge them without warning.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read and write local files and to derive replayable authenticated web requests from a user's HAR/session data, but it does not declare any explicit tool restrictions. In this context, missing scope is dangerous because the skill handles highly sensitive auth material and network-capable workflows that could be overused, exfiltrated, or applied to unintended targets if the hosting agent grants broad default capabilities.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script extracts live authentication material from a HAR and writes it to plaintext files on disk, including Cookie, CSRF, and Authorization headers. In the context of this skill, those values can directly enable authenticated requests as the logged-in user, so accidental disclosure through backups, shared folders, malware, logs, or later reuse materially increases account/session compromise risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This script emits extracted HAR request data directly to stdout and optionally writes it to disk, including full URLs and raw post body text that can contain session cookies, bearer tokens, CSRF values, PII, or business data captured from an authenticated browser session. In the context of this skill, the danger is elevated because the tool is specifically designed to reverse-engineer authenticated workflows, so sensitive auth material is especially likely to be present in the exported data.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md ## Do not do - brute-force hidden endpoints - expand scope beyond the requested workflow - bypass login, MFA, paywalls, or rate limits - reuse someone else's session material - disguise unauthorized access as testing
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md ## Do not do - brute-force hidden endpoints - expand scope beyond the requested workflow - bypass login, MFA, paywalls, or rate limits - reuse someone else's session material - disguise unauthorized access as testing