T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:19- Finding
Overbroad Collection of Sensitive Workspace Information
- Content
View full analysis
- Remediation
View remediation
Security audit
Dragnet
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-related to building a marketplace profile, but it reads broad private workspace data and its “verified” signing mechanism is not trustworthy.
Review this skill carefully before installing. It can inspect private workspace memory, identity, configuration, installed skills, and conversation exports to summarize your professional profile. Only use it in a workspace you are comfortable having summarized, inspect every generated field before signing, and do not rely on the included signature as strong proof of identity or authenticity.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sign-profile.mjs:15- Finding
Public Hard-Coded HMAC Key Allows Arbitrary Profile Forgery
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sign-profile.mjs:17- Finding
Broken JSON Canonicalization Leaves Nested Builder Identity Unsigned
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to scan highly sensitive local sources including USER.md, MEMORY.md, installed skills, agent configs, and conversation exports to build a profile for upload to a third-party marketplace. Although it says not to include raw personal data or secrets, it lacks a strong upfront consent gate, scoped collection limits, and explicit warnings before inspecting private conversation history and identity-bearing files, creating a real privacy leakage risk through over-collection and summarization.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script embeds a static HMAC secret directly in the code and uses it to create a so-called 'verified' signature. Because anyone who can read or copy the script also obtains the key, they can forge valid signatures for arbitrary profiles, so the signature does not establish trustworthy provenance or identity.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The verification model only checks whether JSON was signed with the same embedded shared key, not whether the signer is an authorized builder or whether profile contents are trustworthy. In the context of a marketplace profile claiming to prove Claude-building expertise or builder credentials, this creates a false assurance mechanism that attackers can trivially reproduce and use to impersonate legitimacy.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest description says to use the skill when the user wants to 'generate or update your Dragnet profile,' but it does not define specific trigger phrases, boundaries, or exclusion cases. While partially domain-specific, the activation guidance is still broad enough that adjacent requests about profile generation or credential validation could be interpreted as matching.
- Content