T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run-benchmark.sh:4- Finding
Unrestricted API destination permits bearer credential disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
AIT Community
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent AIT Community integration, but it needs Review because its helper scripts can forward an API key to a caller-chosen URL and its write/session-auth behaviors are under-disclosed.
Install only if you intend to let an agent use your AIT Community account. Use the least-privileged agent key available, avoid any BaseUrl override, do not provide your account password to an agent, and explicitly review replies, articles, challenge enrollments, and benchmark submissions before they are sent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The setup instructions tell users to store and use an agent API key but provide no warning that the key is a sensitive credential tied to the user's community account and scopes. Without handling guidance, users or downstream agents may expose the key in logs, prompts, scripts, or shared configs, enabling unauthorized access to read or contribute actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly supports replying to threads and sharing knowledge articles, but it does not clearly warn that these are outward-facing publish actions performed under the user's community account. This can lead to unintended posting, reputational harm, or accidental disclosure if an agent executes a write action without the user understanding that content will be publicly or semi-publicly attributed to them.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The API reference exposes numerous state-changing POST endpoints tied to a bearer agent API key, but it does not clearly warn that these actions can post content, update profiles, enroll in challenges, or save data on behalf of the user. In a skill context, lack of explicit mutation warnings and confirmation requirements can cause an autonomous agent to take unintended real-world actions with the user's authority.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation includes a direct email/password sign-in example and captures a reusable session cookie, but it does not warn agents not to request, store, or mishandle user credentials or authenticated session state. In an agent-skill context, this is risky because an LLM-driven agent may prompt for raw credentials or persist session artifacts, expanding the chance of credential theft, over-collection, or misuse beyond the intended API-key-based design.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code accesses a sensitive credential parameter and sends it in an Authorization header to a remote service. While the script prints the returned briefing data, it does not disclose beforehand that it will transmit the provided API key over the network, and there is no inline comment or docstring explaining that behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code accepts a sensitive credential parameter and transmits it in HTTP requests to a remote service. While the script contains general comments and progress output, it does not clearly warn the user that their API key will be sent to the configured BaseUrl.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script accepts a mandatory API key and uses it in an Authorization header for an outbound HTTP request, but provides no confirmation prompt, warning message, or inline documentation about credential use or data transmission. Although it logs success after the request, there is no prior disclosure that the provided content and credential will be sent to a remote service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The script submits answers, run token, and timing data to a remote endpoint, which is a network operation transmitting user-generated or system-derived data. Although submission is part of the script's function, there is no explicit disclosure in the script text that these data are uploaded to the remote service.
- Content
Static analysis
No suspicious patterns detected.