T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
Unrestricted User-Controlled URL Fetch Enables SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
YouTube Title Generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward YouTube title generator with disclosed file output and optional URL/reference input, but users should only provide public URLs and non-sensitive material.
Installers should treat this as a normal content-generation skill. Before use, be aware that providing a URL tells the agent to fetch and analyze that page, so only use public, non-sensitive URLs and ignore instructions embedded in fetched pages. The skill will also create a timestamped markdown file under youtube-title/.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The invocation description is broad enough to match many generic ideation requests, increasing the chance the skill is invoked outside a tightly scoped context. Over-broad triggering can cause unnecessary access to files or network behaviors defined later in the skill when the user only wanted general brainstorming.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The accepted input scope includes vague categories plus any URL, without defining when the skill should handle each case. This ambiguity broadens the operational surface and can route arbitrary external content into the skill, making misuse and unintended data handling more likely.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill's declared purpose is title generation, but it also instructs the agent to fetch and analyze arbitrary URLs. That expands the skill from simple text transformation into network-enabled content ingestion, which can expose the agent to untrusted remote content and create behavior users may not expect from the manifest alone.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs fetching arbitrary URLs but gives no user-facing warning that it will perform network access or process external content. This is dangerous because it can surprise users, retrieve malicious or sensitive content from untrusted sources, and create privacy or prompt-injection exposure through remote material.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill writes output to a local file without clearly warning the user that a file will be created. While lower severity than network access, unexpected file creation can violate user expectations, clutter workspaces, or overwrite data depending on implementation details.
- Content
Static analysis
No suspicious patterns detected.