Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent cost-control tool, but its optional watchdog can persistently run and terminate local processes with weak scoping safeguards.
Review carefully before installing. Use a pinned, verified package or the inspected local files, run the watchdog only under a dedicated unprivileged account, protect the state directory from other users, avoid root cron, and treat emergency recovery as an operator-approved action after confirming the runaway condition is fixed.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
Location
README.md:29
Finding
Unpinned Third-Party Package Installation Creates a Supply-Chain Risk
Content
View full analysis
Vulnerability Details
File Location: README.md:29-33; duplicated in SKILL.md:43-47 Vulnerability Type: Unpinned and insufficiently verified third-party dependency Risk Level: Medium
Vulnerable Code
bash
### 1. Install
```bash
pip install cost-control-system
# OR copy cost_control.py to your project
text
The effective security-relevant command is:
```bash
pip install cost-control-system
Technical Analysis
The recommended installation command retrieves the latest available release of cost-control-system from the package index configured for the user's Python environment. It does not specify:
An audited package version.
Cryptographic hashes.
A canonical package repository or verified publisher identity.
Whether the downloaded package corresponds to the source files reviewed in this audit.
Consequently, the behavior of the installed dependency can change after this Skill has been audited. A compromised publisher account, malicious future release, dependency-confusion condition involving a private package index, or package-index compromise could cause users to install code different from the audited local implementation.
Depending on the package format and pip configuration, attacker-controlled code may execute during source-package build steps. In all cases, malicious package code can execute when the installed module or its entry points are subsequently invoked.
Attack Path
An attacker compromises the package publisher, package-index account, or an index selected by the victim's pip configuration.
The attacker publishes a malicious release under the expected cost-control-system name.
A user follows the documented pip install cost-control-system command.
Pip resolves and installs the attacker-controlled release because no version or hash is enforced.
Malicious behavior executes during an applicable build process or when the packa
...[truncated 683 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to a specifically audited release:
bash
Link the canonical source repository and package-index page, and document the verified publisher identity.
Ensure the released package is reproducibly associated with a signed source tag or release commit.
Prefer a virtual environment and an unprivileged service account. Explicitly warn users not to install the package as root.
Present copying the audited local cost_control.py implementation as the preferred path when package provenance cannot be verified.
Apply the same corrections to both README.md and SKILL.md.
T09 · Insecure Skill Coding Practices
Warning
Location
cost_watchdog.py:62
Finding
Watchdog Can Terminate an Unrelated Process Because PID Identity Is Not Authenticated
Content
View full analysis
Vulnerability Details
File Location: cost_watchdog.py:62-110 Vulnerability Type: Unsafe process identification and signaling through a reusable PID file Risk Level: Medium
Vulnerable Code
python
def get_process_pid():
"""Read process PID from PID file."""
if not os.path.exists(PID_FILE):
return None
try:
with open(PID_FILE) as f:
pid = int(f.read().strip())
# Verify process exists
os.kill(pid, 0) # Raises OSError if process doesn't exist
return pid
except (ValueError, OSError):
return None
def kill_process(pid, reason):
"""Kill the process and create emergency flag.
Returns True if successfully killed, False otherwise.
"""
try:
log(f"🚨 KILLING PROCESS (PID {pid}): {reason}")
# Write emergency flag BEFORE killing (prevents restart)
with open(COST_EMERGENCY_FLAG, "w") as f:
f.write(json.dumps({
"reason": reason,
"timestamp": time.time(),
"timestamp_iso": datetime.now().isoformat(),
"killed_pid": pid,
"killed_by": "external_watchdog",
}, indent=2))
log(f"✅ Emergency flag written: {COST_EMERGENCY_FLAG}")
# Kill process (SIGTERM first, then SIGKILL)
os.kill(pid, signal.SIGTERM)
time.sleep(5)
# Check if still alive
try:
os.kill(pid, 0)
log(f"Process still alive after SIGTERM — sending SIGKILL")
os.kill(pid, signal.SIGKILL)
except OSError:
pass # Already dead
log(f"✅ Process killed. Manual intervention required to resume.")
return True
except Exception as e:
log(f"❌ Failed to kill process: {e}")
return Fal
...[truncated 2887 chars]
Remediation
View remediation
Remediation Suggestions
Run the watchdog and protected application under the same dedicated, unprivileged service account. Never install the cron entry in root's crontab unless strictly necessary.
Create the state directory with restrictive permissions, such as mode 0700, and state files with mode 0600. Validate ownership and reject files writable by other users.
Store and validate more than a PID. The application should atomically record:
PID.
Process start time.
Expected executable path.
Service name or cgroup identity.
A cryptographically random instance token shared with the watchdog.
Immediately before every signal, revalidate process identity. Repeat validation after the SIGTERM wait before issuing SIGKILL.
Use platform facilities that maintain process identity safely, such as Linux pidfds, where available.
Prefer a service manager such as systemd and stop a specifically named unit rather than signaling a raw PID from a file.
Atomically create and replace the PID file, remove it during clean shutdown, and reject stale records by comparing the recorded start time with the live process start time.
Validate cost_tracker.json ownership and permissions as well, because writable cost state can be used to trigger the signaling path.
Update the cron documentation in README.md:315-318 and SKILL.md:329-332 to require a dedicated unprivileged account and provide explicit cron removal instructions.
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
93% confidence
Finding
The README instructs operators to clear emergency mode by manually deleting a flag file, which creates an unsafe recovery path that can bypass protective controls without validation or audit. In an agent or automation context, this is more dangerous because a model or script could be induced to run the deletion command automatically, prematurely re-enabling costly or unsafe behavior.
Content
Scanner excerpt · README.md (reported line 152)May include surrounding context.
md
- Send alerts (Discord, Slack, email, etc.)
- System remains alive but paused
**Exit:** Manual intervention required (`rm state/cost_emergency.flag`)
---
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
95% confidence
Finding
Providing 'rm state/cost_emergency.flag' as an alternative to the safer API method encourages direct manipulation of control-state files. This bypasses any safeguards that the application-level clear_emergency() function might enforce and makes it easier for an automated agent, user, or attacker with limited shell access to disable emergency protections unsafely.
Content
Scanner excerpt · README.md (reported line 285)May include surrounding context.
The resume instructions explicitly combine disabling the kill switch with deleting the emergency flag, creating a straightforward recipe to override both layers of protection. In the context of an agent skill, such command snippets are especially risky because they can be copied or executed by automation with minimal scrutiny, undermining the system's fail-safe design.
Content
Scanner excerpt · README.md (reported line 345)May include surrounding context.
Resume After Emergency
bash
python3 kill_switch.py disable
rm state/cost_emergency.flag # Clear emergency flag
# Restart your application
Tp4
High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
A second, stronger description-behavior mismatch indicates the advertised protections may not exist at all beyond local flag handling. This is dangerous because users may integrate the skill as a safety control and then rely on nonexistent cost tracking, monitoring, and hard-cap enforcement, creating a false sense of protection around expensive or critical workloads.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
A second, stronger description-behavior mismatch indicates the advertised protections may not exist at all beyond local flag handling. This is dangerous because users may integrate the skill as a safety control and then rely on nonexistent cost tracking, monitoring, and hard-cap enforcement, creating a false sense of protection around expensive or critical workloads.
Content
No source excerpt is available for this finding.
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
85% confidence
Finding
Directly instructing users to remove a local emergency-flag file is a filesystem-modifying action that bypasses higher-level safety checks and may encourage unsafe manual state manipulation. In agent or automated contexts, file deletion primitives are sensitive because path handling mistakes or generalized adaptation could lead to deletion of unintended files or premature re-enablement after a real incident.
Content
Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
- Send alerts (Discord, Slack, email, etc.)
- System remains alive but paused
**Exit:** Manual intervention required (`rm state/cost_emergency.flag`)
---
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
85% confidence
Finding
The alternative instruction to clear emergency state by deleting a flag file again normalizes direct filesystem mutation as an operational control path. This is risky because operators or automation may use the shell shortcut instead of safer programmatic recovery, bypassing checks, auditing, and validation that should guard a high-impact state transition.
Content
Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.
Combining kill-switch disablement with manual deletion of the emergency flag creates a documented sequence for forcefully re-enabling a system after a protective shutdown. In the context of a tool that can terminate services and affect spend controls, this increases the chance of unsafe restart loops, bypass of intended manual review, and accidental restoration of a still-broken workload.
Content
Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.
Resume After Emergency
bash
python3 kill_switch.py disable
rm state/cost_emergency.flag # Clear emergency flag
# Restart your application
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
This markdown file documents safety-impacting behaviors including killing the entire process and writing a restart-prevention flag. Although the README includes a general liability disclaimer later, it does not clearly warn users near these instructions that enabling the kill switch can abruptly terminate live workloads and require manual recovery.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · README.md (reported line 315)May include surrounding context.
3. Deploy via Cron
bash
crontab -e
# Add this line (run every 2 minutes)
*/2 * * * * cd /your/project && python3 cost_watchdog.py >> logs/watchdog.log 2>&1
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill describes behaviors that require filesystem writes and outbound network activity, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, this weakens user visibility and policy enforcement, increasing the chance that destructive local actions or external alerting/network calls occur without informed consent.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding
The setup and usage sections encourage deployment before clearly foregrounding that the watchdog and kill switch can terminate processes and block restart. For an operational skill that can stop live services, burying destructive behavior later in the document increases the risk of accidental disruption or self-inflicted denial of service.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
86% confidence
Finding
The skill instructs users to install a recurring cron job, which creates persistent execution outside the immediate session. Persistence is not inherently malicious here, but it increases risk because a misconfigured or compromised watchdog can repeatedly run, kill services, write logs indefinitely, or survive after users forget it was installed.
Content
Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
3. Deploy via Cron
bash
crontab -e
# Add this line (run every 2 minutes)
*/2 * * * * cd /your/project && python3 cost_watchdog.py >> logs/watchdog.log 2>&1
Excessive Permissions
Low
Category
Privilege Escalation
Confidence
80% confidence
Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Content
Scanner excerpt · LIMITATIONS.md (reported line 103)May include surrounding context.
md
### Workarounds
- **Monitor disk space:** Alert if state directory partition is >80% full
- **Verify file permissions:** Ensure tracker has write access to state directory
- **Manual kill switch:** Use `kill_switch.py` as backup
### Current Status
Scope Creep
Low
Category
Excessive Agency
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content
Scanner excerpt · README.md (reported line 577)May include surrounding context.
md
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
Scope Creep
Low
Category
Excessive Agency
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content
Scanner excerpt · SKILL.md (reported line 591)May include surrounding context.
md
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
