T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lmstudio-api.mjs:45- Finding
Unrestricted API endpoint permits disclosure of private prompts to remote servers
- Content
View full analysis
- Remediation
View remediation
Security audit
Offload Tasks to LM Studio Models
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for local LM Studio offloading, but it needs Review because private prompts can be sent to a configurable endpoint and persisted without clear warnings.
Install only if you are comfortable with agents sending selected task text to LM Studio. Keep the API URL on localhost unless you intentionally trust a remote server, avoid using it for secrets or regulated data without a clear policy, and do not enable --log for sensitive prompts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lmstudio-api.mjs:61- Finding
Optional logging stores complete prompts and responses in unprotected plaintext files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/lmstudio-api.mjs <model> '<task>' --temperature=0.5 --max-output-tokens=200
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/lmstudio-api.mjs <model> '<task>' --temperature=0.5 --max-output-tokens=200
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/lmstudio-api.mjs <model> '<task>' --temperature=0.5 --max-output-tokens=200
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/lmstudio-api.mjs <model> '<task>' --temperature=0.5 --max-output-tokens=200
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/lmstudio-api.mjs <model> '<task>' --temperature=0.5 --max-output-tokens=200
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/lmstudio-api.mjs <model> '<task>' --temperature=0.5 --max-output-tokens=200
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Optional: POST /api/v1/models/load { model, context_length?, ... }. Or run scripts/load.mjs <model>. JIT: first chat loads; explicit load only for specifi
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ponse only (do not send the model key unless it exactly equals that id). Or run scripts/unload.mjs <model_key> (script does GET then unloads each instance
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states the skill is automatically triggered for broad categories like summarization, classification, brainstorming, and first-pass code review, without clear gating criteria or explicit user confirmation. In an agentic system, this can cause unintended invocation of a local model for sensitive or security-relevant tasks, potentially exposing data to an unintended processing path or producing lower-quality security judgments that influence later actions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill clearly instructs the agent to use network access and local execution (
curl,node scripts/...) but does not declare any explicit tool scope such as allowed tools or permissions. This increases the chance that an agent runtime grants broader capabilities than intended, making misuse or unexpected command/network execution harder to constrain or review.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## Prerequisites LM Studio 0.4+, server :1234, models on disk; load/unload via API (JIT optional); Node for script (curl ok). ## Quick start
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises
--log <path>for request/response logging without warning that prompts, outputs, identifiers, and possibly sensitive task data may be written to disk. In a privacy-sensitive or local-only workflow, silent persistence of full model interactions can create unintended data exposure through log files, backups, or shared workstations.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The --log option appends the full request payload and full API response to an arbitrary file path, which can include sensitive prompts, extracted secrets, private local data, and model outputs. In this skill's context, the tool is explicitly marketed for local-only or privacy-sensitive work, so silent disk persistence of that content increases confidentiality risk if logs are later read by other users, backup systems, or malware.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The smoke test sends a chat request with
store: true, which explicitly instructs the LM Studio server to retain the conversation. Because this skill is marketed for local-only and privacy-sensitive work, storing even a trivial prompt without disclosure or opt-in can create unexpected data retention and weaken privacy guarantees if the script is reused with nontrivial prompts or against a shared server.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill recommends unloading all instances for a model key and even provides automation to do so, but it does not warn that these instances may be shared with other active local workflows. This can disrupt concurrent sessions, terminate in-progress tasks, or cause availability issues for other users/processes on the same machine.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/lmstudio-api.mjs:12
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/load.mjs:8
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/test.mjs:9
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/unload.mjs:9