T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/morning_briefing.sh:11- Finding
Hard-Coded Cross-User Credential File Access
- Content
View full analysis
- Remediation
View remediation
Security audit
기상청 날씨 (KMA Weather Korea)
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a Korea weather and air-quality purpose, but one script reads an API key from a hard-coded other-user home path, which is a real credential-scope problem.
Install only if you are comfortable fixing or accepting the credential handling risk. Before use, change morning_briefing.sh to read the invoking user's configured key, store the key with 0700 directory and 0600 file permissions, and rotate the key if it was previously exposed through shell history or process monitoring.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:144- Finding
API Key Setup Does Not Enforce Restrictive File Permissions
- Content
View full analysis
~/.config/data-go-kr/api_key ``` ### Technical Analysis The documented setup procedure creates the configuration directory and API-key file without explicitly setting secure permissions. Their resulting permissions depend on the user's current `umask`. Under a permissive `umask`, the API-key file or its parent directory may be readable or traversable by other local users. The command also encourages users to place the API key directly in an interactive shell command, which may save the credential in shell history. Credentials should be created with deterministic, restrictive permissions rather than relying on ambient system configuration. ### Attack Path 1. A user follows the documented setup instructions on a multi-user system. 2. The user's `umask` permits group or world read access. 3. The resulting `api_key` file is created with insufficiently restrictive permissions. 4. Another local user traverses the configuration directory and reads the file. 5. The attacker uses the recovered credential against the data.go.kr APIs, consuming the victim's quota or impersonating the victim's API access. A second exposure path exists if the user substitutes the actual key directly into the `echo` command and the shell records that command in persistent history. ### Impact Assessment An attacker with local account access may obtain the data.go.kr API key. The recovered key can be used from another system for any API services authorized under that credential, potentially consuming quotas, disrupting legitimate calls, and causing malicious activity to be attributed to the credential owner. This does not directly expose arbitrary files or grant operating-system privileges. Its scope is the API account and services associated wi ...[truncated 25 chars]- Remediation
View remediation
"$HOME/.config/data-go-kr/api_key" unset API_KEY ``` Additional hardening should include: - Require directory mode `0700` and file mode `0600`. - Avoid putting the actual key directly in a command that may be written to shell history. - Document how users can verify permissions with `stat`. - Have the scripts reject credential files that are group- or world-readable. - Recommend rotating the key if it was previously stored with permissive permissions or entered directly into shell history. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/weather.sh:120- Finding
API Key Exposed Through Curl Process Arguments
- Content
View full analysis
` value in curl's process argument list. Depending on the operating system's process visibility policy, other local users, monitoring agents, diagnostic tools, or process supervisors may be able to inspect those arguments while the request is running. Using HTTPS protects the request from ordinary network interception, but it does not protect secrets exposed locally before curl establishes the encrypted connection. The network transmission itself is necessary for API authentication and is sent only to the documented `https://apis.data.go.kr` endpoint; the vulnerability is the local argv exposure. ### Attack Path 1. A user or automated service invokes `scripts/weather.sh`. 2. The shell expands `$API_KEY` into the curl command-line arguments. 3. Curl remains active while DNS resolution, connection setup, or the API request is in progress. 4. A local attacker or monitoring process reads the curl command line through process-inspection facilities. 5. The attacker extracts the `serviceKey` value. 6. The attacker reuses the key to make unauthorized data.go.kr API requests. The practical exploitation window may be short, but repeated or scheduled weather requests make observation easier. ### Impact Assessment A local attacker who can inspect process arguments may recover the API key and use all data.go.kr services authorized for it. Potential effects include qu ...[truncated 318 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest presents the skill as weather-only, while the documentation also includes cross-skill air-quality access and local credential file reads. Hidden or under-declared capabilities reduce transparency and can lead operators to grant or trust broader data access than intended, especially when local file access is involved.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The manifest presents the skill as weather-only, while the documentation also includes cross-skill air-quality access and local credential file reads. Hidden or under-declared capabilities reduce transparency and can lead operators to grant or trust broader data access than intended, especially when local file access is involved.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents shell scripts and outbound API usage but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, this creates an authorization gap where the runtime may permit broader shell or network access than users expect, increasing the chance of unintended command execution or external requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description omits documented air-quality and notification-related scope, creating a capability disclosure gap. In agent ecosystems, incomplete disclosure can mislead reviewers and users about what external systems the skill may contact or what downstream actions it may trigger.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The intent router lists common conversational phrases such as "오늘 날씨 어때?", "기온 몇 도?", and routes based on simple keywords like 현재/지금, 내일/모레/주말, 브리핑. These are broad natural phrases and the file does not provide negative examples or constraints describing when the skill should not activate, increasing the risk of unintended invocation overlap with ordinary conversation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The setup instructs users to persist an API key in a plaintext file under the home directory. Plaintext credential storage increases the risk of credential theft by other local processes, overly permissive file permissions, backups, or accidental disclosure through logs and support bundles.
- Content
- 로그인 → 마이페이지 → 일반 인증키(Decoding) 복사
- API 키 저장:
bash mkdir -p ~/.config/data-go-kr echo "YOUR_API_KEY" > ~/.config/data-go-kr/api_key - 아래 서비스 활용신청 후 사용 (자동승인)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script directly reads an API key from a sensitive local path, which is credential access covered by the missing-warning rule for code files. There is no confirmation prompt, user-facing disclosure, or explanatory comment warning that the skill accesses a credential file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes the skill as a KMA short-term forecast API for ultra-short-term observation and short-term forecast. In addition to those expected KMA weather calls, the code performs a separate AirKorea API request for particulate and ozone data, which is a distinct capability not covered by the stated description.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script's human-facing comments, accepted aliases, and error/help text are partly or wholly Korean-specific, including Korean trigger values like 실황, 초단기, 예보, 단기, and 버전. Under the language/locale policy, forcing a specific language without user opt-in or clear justification is a policy concern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "API: $ENDPOINT | Date: $BASE_DATE | Time: $BASE_TIME | Grid: ($NX,$NY)" >&2 # 요청 실행 RESPONSE=$(curl -s -G "$URL" --data-urlencode "serviceKey=$API_KEY" \ --data "pageNo=1" \ --data "numOfRows=1000" \ --data "dataType=JSON" \
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Most trigger examples, routing logic, setup text, and response guidance are written only in Korean, and the skill does not state that language handling is limited to Korean or offer any user language choice. This can violate a language/locale policy when a skill implicitly forces one language without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language comments, usage text, default station name, and output labels indicate the skill is designed specifically for Korean-language use, but there is no visible opt-in or documented locale restriction. This can violate the language/locale policy when a skill implicitly forces a specific language without user choice.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest only states a weather forecast API purpose and does not mention local file access or credential loading behavior. While credentials may be needed operationally, reading a specific user-home config file is an additional capability outside the manifested intent as written.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This shell script accesses a sensitive API key from the user's config directory and later transmits it to a remote weather API. Although the code has developer comments and debug output, there is no explicit user-facing disclosure that credentials will be read and used in a network request.
- Content
Static analysis
No suspicious patterns detected.