T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:157- Finding
Broad Environment-Variable Enumeration Can Disclose Unrelated Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Azure DevOps 基础版
Security checks for vulnerabilities and agentic risk
Overview
This Azure DevOps skill is mostly purpose-aligned, but it uses authenticated command execution for remote repository actions while under-disclosing network use and using overly broad triggers.
Review this carefully before installing. Use a least-privilege Azure DevOps PAT, avoid running the broad environment-check commands, and require explicit confirmation before any POST or other mutating Azure DevOps request. The skill should be narrowed to Azure DevOps tasks and should disclose that it sends authenticated data to Azure DevOps over HTTPS.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:111- Finding
Azure DevOps PAT Is Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
"$curl_config" curl --config "$curl_config" \ "https://dev.azure.com/${AZURE_DEVOPS_ORG}/_apis/projects?api-version=7.1" ``` The temporary file must remain owner-readable only and must be removed on both successful and interrupted execution. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description contains catch-all usage cues like coding assistance, debugging, testing, and deployment, which are far broader than the documented functionality. That makes accidental invocation more likely during ordinary developer conversations, raising the risk of authenticated external actions being taken out of context.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger text is overly broad and mismatched to the skill's actual Azure DevOps scope, increasing the chance that an agent invokes it for unrelated data-analysis or reporting tasks. In a tool with exec and write capabilities plus authenticated network access, overbroad activation can lead to unnecessary external calls or unintended repository actions.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document claims data remains local and is not uploaded to the cloud, but the skill's primary function is making authenticated Azure DevOps API requests over the network. This can create a false sense of privacy and cause users to expose repository metadata, pull-request content, or token-scoped operations without informed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description states the skill '支持创建拉取请求和查看工作项', implying work-item viewing is part of the skill's scope. However, the capability list in the body enumerates only five functions, none of which involve querying or viewing work items, and line L102 incorrectly claims all description keywords are covered.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description says the skill is suitable for '企业团队和自动化工作流场景'. In contrast, the version-positioning table states the FREE version does not support team collaboration and is targeted at personal users, creating a semantic mismatch about intended usage and capability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description states '支持中文交互' as a default capability, and the document consistently presents usage as Chinese-only without indicating that the user can choose another language. This can violate language/locale policy when a skill imposes a language preference without explicit user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples demonstrate authenticated Azure DevOps API calls, including a POST that creates a pull request, without a prominent warning that they perform external network operations and modify remote repositories. Users or agents may treat these as harmless examples and trigger real changes with production credentials.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The skill includes an authenticated curl POST to Azure DevOps that transmits data externally and creates a pull request on a remote service. In context, external transmission is expected for this kind of tool, but it is still security-relevant because it uses a PAT and performs a repository-modifying action that could be invoked by an agent with exec access.
- Content
从功能分支向主干创建拉取请求,附带描述与审阅说明
bash curl -s -u ":${AZURE_DEVOPS_PAT}" -H "Content-Type: application/json" -X POST -d '{"sourceRefName":"refs/heads/feature/x","targetRefName":"refs/heads/main","title":"feat: add login"}' "https://dev.azure.com/${ORG}/${PROJ}/_apis/git/repositories/${REPO_ID}/pullrequests?api-version=7.1"不适用场景