Security audit

TeamApp Admin

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent as a TeamApp admin helper, but it handles live admin sessions in an under-scoped way that could expose credentials or enable unintended administrative changes.

Review before installing. Only use this with a low-privilege TeamApp account if possible, never pass non-TeamApp URLs to the wrapper, clear /tmp session files after use, and require explicit confirmation before publishing, notifying users, changing teams/access groups, or using archive/delete endpoints.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: bin/api-wrapper.sh:58
Finding: Authentication Token Forwarded to an Unrestricted Caller-Controlled Host
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: bin/api-wrapper.sh:11
Finding: Session Secrets Stored in Predictable Shared Temporary Files
Content: View full analysis
"$CSRF_FILE" ``` It subsequently trusts and reuses the files solely based on their existence: ```bash # Ensure session exists if [ ! -f "$COOKIE_JAR" ] || [ ! -f "$CSRF_FILE" ]; then bootstrap_session fi # Read CSRF Token CSRF_TOKEN=$(cat "$CSRF_FILE") ``` ### Technical Analysis Both files have fixed names under the globally shared `/tmp` directory. The script does not create a private temporary directory, set a restrictive `umask`, validate file ownership, reject symbolic links, or isolate state by process, operating-system user, or TeamApp account. The CSRF token is written through ordinary shell redirection, so its resulting permissions depend on the invoking process's umask. Existing files are trusted without verifying that they were created by the current execution. Concurrent invocations can also share or overwrite the same cookie and CSRF state. This design exceeds the minimum persistence needed for the wrapper. Session data can instead be held in process-private temporary files and deleted after use. ### Attack Path A local exploitation path is as follows: 1. An attacker with access to the same host predicts the fixed `/tmp/teamapp_csrf.txt` or `/tmp/teamapp_cookies.txt` path. 2. The attacker creates a conflicting file or symbolic link before the wrapper runs, or waits for insecurely perm ...[truncated 1181 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents shell execution via bin/api-wrapper.sh but declares no explicit tool restrictions such as allowed-tools or permissions. That mismatch increases the chance an agent can invoke broader shell capabilities than intended, which is risky because the skill also handles authenticated session material and performs live write operations against an admin API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill provides instructions for creating/updating live news and events and for sending notifications, but it does not warn that these actions affect real users and production data. In an admin context, silent or mistaken execution can spam members, publish unintended content, or schedule misleading events, making the operational impact significant even without code execution exploits.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill is for News and Schedule CRUD plus ID resolution, but the documentation also references team[access_level_ids_csv], implying modification of team settings outside the declared scope. Scope drift is dangerous because agents and reviewers may authorize the skill expecting content operations only, while the documented fields enable broader administrative changes affecting access control or visibility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script requires the sensitive environment variable TA_AUTH_TOKEN and later sends it in HTTP Cookie headers, but the visible comments and usage text do not warn that a credential will be consumed and transmitted. For a code file, sensitive credential handling without an explicit disclosure or warning meets the missing user warning criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The bootstrap request sends the authentication token to a remote service and stores session cookies, but the script's user-facing description only says it handles authentication automatically. Because it performs authenticated HTTP calls that transmit user/session data without an explicit warning or confirmation, this is a missing user warning for code files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented API surface exceeds the declared skill scope by including Access Group and Team create/update operations, and notes delete capabilities for those resources. In an agent setting, this broadens what the skill may enable beyond user expectations, increasing the risk of unauthorized or unintended administrative changes if the agent relies on this reference as operational guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The API map explicitly mentions archive and hard delete URLs for Access Groups without any safety notes, confirmation requirements, or warnings about destructive impact. In a skill intended for agent use, omission of such guardrails makes accidental or overly broad destructive actions more likely, especially when combined with admin-level endpoints.
Content: No source excerpt is available for this finding.