T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:38- Finding
Externally Exposed WebSocket Service Without Documented Authentication or Transport Security
- Content
View full analysis
- Remediation
View remediation
Security audit
Pywayne Cross Comm
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate communication purpose, but its examples encourage broad network exposure and automatic file transfer behavior without enough access-control guidance.
Review before installing or using in shared networks. Bind servers to localhost unless you explicitly need remote access, add authentication and TLS, restrict allowed senders, avoid broad auto-download listeners, quarantine and validate received files, and be deliberate about any local files or folders sent to Aliyun OSS.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:145- Finding
Automatic Persistence of Remotely Supplied Files Without Documented Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
File transfers use Aliyun OSS. Set these environment variables:
bash # .env file OSS_ENDPOINT=your-oss-endpoint OSS_BUCKET_NAME=your-bucket-name OSS_ACCESS_KEY_ID=your-access-key
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented listener behavior shows automatic downloading of remote file content into a local directory, but it does not clearly warn that untrusted remote content will be written to the filesystem. This increases the risk of users enabling auto-downloads without considering disk-write side effects, malware staging, or unsafe handling of attacker-controlled filenames/content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly states that sending files, images, and folders will automatically upload local content to Aliyun OSS, but it does not prominently warn that local data is being transmitted to a third-party remote service. In an agent setting, this can lead to unintended exfiltration of sensitive local files or directories if a caller assumes these are local-only transfers.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents default client ID generation using the device MAC address plus a UUID suffix, which exposes a persistent hardware-derived identifier without explicit user consent. This can enable cross-session tracking, device correlation, and disclosure of sensitive host identity information in environments where anonymity or privacy is expected.
- Content
Static analysis
No suspicious patterns detected.