T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:206- Finding
Unsafe Sourcing of a Project-Local Environment File from Cron
- Content
View full analysis
- Remediation
View remediation
Security audit
dashboard-builder-free
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed local dashboard builder, but its examples could expose API keys or unintentionally expose dashboards if followed as written.
Review before installing. Use restricted API keys, do not print full credentials, do not source a project-local .env file from cron, bind preview servers explicitly to 127.0.0.1, and inspect any generated fetch.sh before scheduling it. I found no hidden code or clear malicious payload, but the credential and local exposure guidance needs careful handling.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:239- Finding
API Credential Exposure Through Troubleshooting Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The guidance recommends storing API credentials in
./.env, which is commonly left in project directories and may be accidentally committed, copied, or exposed to other local tooling. Even though environment variables are better than hardcoding, encouraging plaintext secrets in a workspace-local file increases the chance of credential leakage.- Content
所有 API 凭据通过环境变量注入，禁止写入脚本或配置文件。在 cron 中使用环境变量文件：
bash # /etc/environment 或 ./.env STRIPE_API_KEY=sk_demo # ... # cron 中加载
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The cron example
source ./.env && ./dashboard/stripe/fetch.shencourages loading secrets from a relative local file at execution time. This pattern can leak credentials through mislocated working directories, unsafe file permissions, accidental repository inclusion, or unintended reuse by other scripts in the same environment.- Content
STRIPE_API_KEY=sk_demo
...
cron 中加载
*/15 * * * * source ./.env && ./dashboard/stripe/fetch.sh
text ### 2. 本地绑定 127.0.0.1
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The visible skill name and descriptive text are written in Chinese, and the file does not indicate that the skill supports other languages or will adapt to the user's preferred locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest emphasizes a '本地' static dashboard generation workflow, but the documented behavior explicitly includes generating fetch scripts for external APIs such as Stripe and monitoring multiple API endpoints. While dashboards may be rendered locally, the skill's actual documented operations extend into network data collection, which is broader than a purely local dashboard builder description suggests.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document claims the dashboard binds to 127.0.0.1 by default, but the quick-start later uses
python -m http.server 8080without--bind 127.0.0.1and even references an external URL. This inconsistency can cause users to expose dashboards and embedded business data on all interfaces unintentionally.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The server monitoring example directs the agent to generate scripts that execute host-level commands like top and free to inspect CPU, memory, and disk usage. Dashboard generation can justify rendering and data formatting, but direct host interrogation is a separate system-monitoring capability that is not clearly declared in the manifest's stated purpose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger section says to use the skill whenever the user needs data analysis, report generation, statistical insights, or data visualization. Those are broad, everyday request categories and do not clearly distinguish when this dashboard-building skill should activate versus when a different analysis or reporting skill should not.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
#!/bin/bash
Stripe 余额抓取
安全数据传输示例:" \
https://api.stripe.com/v1/balance
| jq '.' > ./dashboard/stripe/data.jsontext