T09 · Insecure Skill Coding Practices
Error
- Location
scripts/monitor.py:262- Finding
Unrestricted Feed and Entry URLs Enable Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Product Launch Monitor
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it advertises, but it needs review because it can fetch and screenshot unvalidated URLs from feeds and then asks agents to read reports containing untrusted web content.
Install only if you are comfortable with the skill making broad outbound web requests and rendering feed-provided pages from the machine running the agent. Prefer trusted feed lists, use --no-screenshots for untrusted feeds, avoid running it in environments with access to internal services or cloud metadata, and treat all generated reports, JSON, screenshots, and links as untrusted web data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/monitor.py:356- Finding
Attacker-Controlled Feed Content Is Exposed to the Agent as Trusted Report Text
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Tainted flow: 'api_key' from os.environ.get (line 146, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def _brave_search(query, api_key): import requests try: resp = requests.get( "https://api.search.brave.com/res/v1/web/search", params={"q": query, "count": 5}, headers={"Accept": "application/json", "X-Subscription-Token": api_key},
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises an end-to-end pipeline that performs network access, reads environment variables, and writes reports/screenshots to disk, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause an agent platform to invoke the skill without clear least-privilege boundaries, increasing the risk of unintended outbound requests, secret exposure through env access, or uncontrolled file creation in the workspace.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests try: resp = requests.get( "https://api.search.brave.com/res/v1/web/search", params={"q": query, "count": 5}, headers={"Accept": "application/json", "X-Subscription-Token": api_key}, timeout=15,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests from bs4 import BeautifulSoup try: resp = requests.post( "https://html.duckduckgo.com/html/", data={"q": query}, headers={"User-Agent": "Mozilla/5.0"},
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script silently consumes BRAVE_API_KEY from the environment to access a third-party service, but the user-facing usage text does not clearly disclose that a credential may be used or sent externally. In agent/skill contexts, undisclosed use of ambient credentials can surprise operators and create governance or data-handling risk even when the destination is legitimate.
- Content