T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:28- Finding
Unrestricted Credential-Bearing Network Requests and Unsafe Shell Fallback
- Content
View full analysis
- Remediation
View remediation
Security audit
Smart API Connector
Security checks for vulnerabilities and agentic risk
Overview
This API helper is mostly purpose-aligned, but it under-discloses a shell/curl fallback and can send user-provided credentials to arbitrary endpoints.
Install only if you are comfortable with the agent making outbound API calls on your behalf. Use scoped or test credentials, verify the exact hostname before any authenticated request, avoid production secrets, and do not allow the exec/curl fallback unless you explicitly need it and can review the command safely.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest presents the skill as a built-in web_fetch connector, but the body introduces an alternative path using exec/curl. This mismatch can cause the orchestrator or user to approve the skill under a narrower trust model than it actually uses, leading to unintended command execution capability in practice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description is very broad and can cause the skill to trigger on a wide range of generic API-related requests. Over-broad activation is risky here because the skill is capable of making outbound authenticated requests and, per the documentation, may escalate to exec/curl fallback, so accidental invocation could lead to unnecessary external data transmission or use of a broader execution path than intended.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md User provides: API URL + what they want. Agent handles everything. > User: "Hent brukerinfo fra https://api.example.com/v1/users/123" > > Agent runs: `web_fetch https://api.example.com/v1/users/123` (with auth headers if provided) >
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md User provides: API URL + what they want. Agent handles everything. > User: "Hent brukerinfo fra https://api.example.com/v1/users/123" > > Agent runs: `web_fetch https://api.example.com/v1/users/123` (with auth headers if provided) >
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Introducing exec/curl broadens the skill from a web request helper into one that may invoke a shell, which is a materially more powerful capability than advertised. Even though the example is simple, normalizing exec as a fallback increases the chance of unsafe handling of user-supplied URLs, headers, or tokens and undermines least-privilege expectations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims it does not require external tools, yet elsewhere instructs the agent to fall back to shell execution via exec/curl. That discrepancy weakens user expectations and expands the execution surface from constrained web_fetch to general command execution, which can expose secrets in process arguments, bypass tool-level safeguards, or enable command-injection-adjacent misuse if future prompts are interpolated unsafely.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrase 'query {url}' is generic enough to match innocuous requests without sufficient context or confirmation. In a skill that can contact arbitrary external endpoints, generic triggers increase the chance of accidental outbound requests, though the impact is lower than direct code execution because the action is still within the stated API-calling domain.
- Content
Static analysis
No suspicious patterns detected.