T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/veillabs-client.sh:5- Finding
Unrestricted API Base URL Can Expose Privacy-Sensitive Financial Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Veillabs Integration
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Veillabs crypto API skill, but it can create swap and distribution orders and send wallet and transaction details to a configurable endpoint without explicit confirmation safeguards.
Review this skill carefully before installing. Use only the official HTTPS Veillabs API endpoint unless you are intentionally developing locally, verify all wallet addresses and amounts yourself, and require an explicit confirmation before any POST that creates a swap or distribution. Do not provide private keys, seed phrases, or wallet credentials to this skill.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill is marked user-invocable and performs external API-driven financial operations, but it does not declare any explicit tool scope or allowed-tools boundary despite static analysis detecting shell-capable code paths. Missing tool restrictions can let an agent invoke broader execution capabilities than users expect, increasing the blast radius if prompts, future edits, or integrations cause shell use during a funds-moving workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill facilitates swaps and seed distributions that can move user funds and send wallet addresses and transaction metadata to an external API, yet it provides no prominent user warning or consent step. In a privacy-focused cryptocurrency context, omission of a warning is especially dangerous because users may not realize they are authorizing irreversible asset transfers and external data disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation instructs an agent to create cryptocurrency swaps and multi-destination fund distributions but does not require an explicit user confirmation or warning that blockchain transfers are irreversible and that a wrong destination address can permanently lose funds. In an agent setting, this omission is risky because users may treat the workflow as routine API automation and overlook the high-stakes nature of sending assets to generated deposit addresses or specified recipient wallets.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi # Prevent curl from reading local files via -d @filename if [[ "$BODY" == @* ]]; then echo "Error: Data body cannot start with '@' for security reasons." exit 1
Static analysis
No suspicious patterns detected.