T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:10- Finding
Plaintext Storage of Qlik Cloud API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Qlik Cloud
Security checks for vulnerabilities and agentic risk
Overview
This Qlik Cloud skill matches its stated purpose, but it asks users to store an API key in a Markdown file and lists powerful tenant-changing actions without clear confirmation safeguards.
Review this skill before installing. Use a least-privilege Qlik API key, avoid storing it in TOOLS.md, and require explicit confirmation before deletion, reload, automation, alert, or other tenant-changing actions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description includes broad triggers like analytics dashboards, data reloads, and querying business data using natural language, which can match common enterprise requests and cause the agent to invoke this skill outside a narrowly scoped Qlik-specific context. Because the skill exposes sensitive read and write operations against a cloud tenant, overbroad activation increases the chance of unintended access, data disclosure, or operational actions in the wrong context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises destructive and action-oriented operations such as app deletion, app creation, reload triggering, reload cancellation, automation execution, and alert triggering without any warning, confirmation, or approval guidance. In an agentic setting, this can enable accidental or unauthorized state-changing actions against production analytics assets and workflows, especially when combined with the broad activation scope.
- Content
Static analysis
No suspicious patterns detected.