T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get-last-trade.sh:18- Finding
API Credential Exposed Through Command-Line URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Massive Financial Connector
Security checks for vulnerabilities and agentic risk
Overview
This market-data skill is purpose-aligned, but it runs unpinned remote MCP code and handles the API key in riskier-than-necessary ways.
Install only if you are comfortable giving this skill access to a Massive API key and running the Massive MCP server from GitHub at launch time. Prefer a version pinned to an immutable commit or verified package, remove ~/.zshrc sourcing, and avoid URL-query API keys before using it in a sensitive environment.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/start-mcp-server.sh:4- Finding
Unnecessary Execution of User Shell Startup Configuration
- Content
View full analysis
/dev/null 2>&1 || true ``` `scripts/get-last-trade.sh:9` and `scripts/get-prev-close.sh:9`: ```bash source "$HOME/.zshrc" >/dev/null 2>&1 || true ``` `scripts/get-agg-day.sh:10`: ```bash source "$HOME/.zshrc" >/dev/null 2>&1 || true ``` The startup-file execution is followed by credential retrieval such as: ```bash KEY="${MASSIVE_API_KEY:-}" KEY="${KEY#\"}"; KEY="${KEY%\"}"; KEY="${KEY#\'}"; KEY="${KEY%\'}" ``` ### Technical Analysis A shell startup file is executable shell code and can contain aliases, command substitutions, network operations, environment mutations, or arbitrary program invocations. These scripts source `$HOME/.zshrc` even though their documented requirement is only that `MASSIVE_API_KEY` be available in the environment. This unnecessarily expands the scripts' trust boundary to all code contained in `.zshrc`. Redirecting output and appending `|| true` does not make execution safe; it merely hides output and suppresses startup-file failures, making unexpected behavior harder to diagnose. This does not establish a new privilege boundary because `.zshrc` ordinarily belongs to the invoking user. However, if that file has already been modified by another process, shared configuration, or an attacker with write access, invoking any affected script triggers the inserted commands. ### Attack Path 1. An attacker or compromised local component obtains the ability to modify the invoking user's `.zshrc`. 2. The attacker inserts a command into the file, such as launching another executable or copying environment variables. 3. The user invokes any affected script. 4. The script sources `.zshrc` ...[truncated 677 chars]- Remediation
View remediation
/dev/null 2>&1 || true ``` 2. Require callers to export `MASSIVE_API_KEY` before invoking the scripts, as already stated in `SKILL.md`. 3. If file-based configuration is necessary, use a dedicated configuration file containing only data rather than executable shell syntax. 4. Validate the dedicated file's ownership and permissions before reading it; reject files writable by unauthorized users. 5. Do not silently suppress configuration errors. Return a clear error without exposing the credential. 6. Run the scripts with the minimum user privileges required for market-data access. ]]>
T03 · Remote Payload Retrieval and Execution
Warning
- Location
scripts/start-mcp-server.sh:14- Finding
Runtime Retrieval and Execution of Code Referenced by a Mutable Git Tag
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description claims broad capabilities including official MCP server startup, endpoint discovery, generic API access, and SQL-style querying, but the analyzed content does not substantiate those features. This mismatch is security-relevant because overstated capabilities can cause operators or agents to trust the skill with sensitive data, execution privileges, or workflows it was not actually designed or reviewed to handle.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
scripts/get-agg-day.sh AAPL 2026-03-05
text ## Output rules - Return concise numeric result first (e.g., last trade price), then timestamp/exchange metadata. - If Massive is unavailable, state failure explicitly and ask whether to use a fallback source.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and invokes shell-based scripts but does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens sandboxing and review controls because an agent may execute local shell commands with broader access than users expect, especially in a skill that handles environment-based API credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script includes the API key directly in the request URL query string when calling the external Massive endpoint. Query-string credentials are commonly exposed through shell history, process listings, debugging output, proxy logs, and upstream server logs, so this creates unnecessary credential leakage risk even though the destination is the expected vendor API.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script sources the user's ~/.zshrc before making a network request, which executes arbitrary shell code from a broad, unrelated startup file in the script's trust context. That expands the attack surface significantly: a malicious or unexpected .zshrc can run commands, alter PATH/functions, or tamper with the API key and curl behavior when the script is invoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sources the user's shell profile and reads MASSIVE_API_KEY, which is sensitive credential material. While it errors if the key is absent, there is no user-facing notice, comment, or documentation in this file explaining that the skill reads credentials from the environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The curl command sends the requested symbol and API key to api.massive.com, which is an outbound network operation involving user/system data. The file contains no prompt, warning, or explanatory comment disclosing that it will contact an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi RESP=$(curl -sS "https://api.massive.com/v2/aggs/ticker/${SYMBOL}/prev?adjusted=true&apiKey=${KEY}") python3 - <<'PY' "$RESP" import json,sys r=json.loads(sys.argv[1])
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi RESP=$(curl -sS "https://api.massive.com/v2/aggs/ticker/${SYMBOL}/prev?adjusted=true&apiKey=${KEY}") python3 - <<'PY' "$RESP" import json,sys r=json.loads(sys.argv[1])
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi RESP=$(curl -sS "https://api.massive.com/v2/aggs/ticker/${SYMBOL}/prev?adjusted=true&apiKey=${KEY}") python3 - <<'PY' "$RESP" import json,sys r=json.loads(sys.argv[1])
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The API key is placed directly in the request URL, which increases exposure through shell history, process listings, debugging output, proxy logs, monitoring systems, and any tooling that records full URLs. Although the call uses HTTPS, URL query parameters are commonly logged more broadly than headers, so the secret may leak to local or intermediary observability layers.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sources the user's ~/.zshrc to obtain environment state, which executes arbitrary shell code from a broad, user-controlled startup file. In a skill context, this expands the trust boundary unnecessarily: running a simple quote lookup can trigger unrelated commands, aliases, prompts, network calls, or secrets-handling logic embedded in that file.
- Content