Poc Validator

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:25 PM UTC
• Version: 0.1.0

Overview

This skill is a coherent PoC replay tool, but it needs Review because it can actively probe targets with sensitive headers and unsafe guardrails.

Install only for controlled security testing on systems you own or are authorized to assess. Avoid passing production cookies or tokens, do not use the documented shell command template with untrusted request data, and treat results cautiously because HTTPS verification is disabled by default.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:16
• Finding: Shell Command Injection Through the Documented Execution Template## Vulnerability Details **File Location**: `SKILL.md`, lines 16–18 **Vulnerability Type**: Shell command injection caused by unsafe interpolation of user-controlled values **Risk Level**: High ### Vulnerable Code ```markdown 2. Format the request data and pass it to the `scripts/replay.py` execution script. - Command execution example: `python3 scripts/replay.py --url "{URL}" --method "{METHOD}" --data "{PAYLOAD}" --headers "{JSON_HEADERS}"` ``` ### Technical Analysis The Skill instructs the Agent to place the user-provided URL, HTTP method, payload, and headers directly into a shell-style command. Double quotation marks do not safely neutralize arbitrary shell input. A value containing a quotation mark followed by shell operators, command substitution, or other metacharacters can terminate the intended argument and introduce an additional command. The Python script itself uses `argparse` and does not invoke a shell. The vulnerability arises when the Agent follows the documented template by constructing a command string and executing it through a shell. Exploitability therefore depends on the command-execution tool using shell parsing, but the documentation does not require a safe argument-array invocation or validation of the interpolated values. ### Attack Path 1. An attacker asks the Agent to validate a PoC and supplies a crafted URL, payload, or header value containing a closing quotation mark and shell syntax. 2. The Agent substitutes the attacker-controlled value into the command template from `SKILL.md`. 3. The Agent passes the resulting command string to a shell-based execution facility. 4. The shell interprets the injected syntax as a separate command rather than as part of the HTTP request argument. 5. The injected command executes with the operating-system privileges and filesystem access assigned to the Agent process. ### Impact Assessment Successful exploitation can provide arbitrary local command e ...[truncated 435 chars]
• Remediation: ## Remediation Suggestions - Do not construct a shell command by interpolating request data into a command string. - Invoke the script through an argument array with shell processing disabled, equivalent to: ```python subprocess.run( [ "python3", "scripts/replay.py", "--url", url, "--method", method, "--data", payload, "--headers", json.dumps(headers), ], shell=False, check=True, ) ``` - Update `SKILL.md` to explicitly prohibit shell interpolation and require structured tool arguments. - Prefer passing the complete request definition through standard input or a securely created JSON file instead of command-line arguments. This also reduces exposure of payloads and authentication headers in process listings. - Validate the HTTP method against an allowlist and validate that headers are a JSON object before execution. - Apply least-privilege sandboxing to the replay process, including restricted filesystem and network access. - Add regression tests using quotation marks, command substitutions, newlines, and shell metacharacters to confirm that all supplied values remain literal arguments.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/replay.py:8
• Finding: Unconditional Disabling of HTTPS Certificate Verification## Vulnerability Details **File Location**: `scripts/replay.py`, lines 8–9 and 52–54 **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: Medium ### Vulnerable Code ```python # Disable HTTPS warnings for self-signed certificates urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) ``` ```python if args.method.upper() == "POST": if "Content-Type" not in headers: headers["Content-Type"] = "application/x-www-form-urlencoded" response = requests.post(args.url, data=args.data, headers=headers, verify=False, proxies=proxies, timeout=15) else: response = requests.get(args.url, params=args.data, headers=headers, verify=False, proxies=proxies, timeout=15) ``` ### Technical Analysis Both request paths explicitly use `verify=False`, causing the HTTP client to accept certificates that are expired, self-signed, issued for another host, or signed by an untrusted authority. The script also globally suppresses `InsecureRequestWarning`, removing the principal runtime indication that server authentication has been disabled. HTTPS encryption without certificate verification does not establish the identity of the destination server. A network-positioned attacker or an attacker controlling the configured proxy can present an arbitrary certificate and impersonate the target. This is particularly significant because the Skill is designed to forward user-supplied cookies, authorization data, payloads, and other headers, and because its conclusions depend on the authenticity of returned status codes and error traces. ### Attack Path 1. The operator replays a PoC against an HTTPS endpoint, potentially including cookies or authorization headers. 2. A malicious network intermediary, compromised gateway, or untrusted proxy intercepts the connection. 3. The intermediary presents a certificate that would normally fail hostname or trust-chain validation. 4. The script accepts the c ...[truncated 748 chars]
• Remediation: ## Remediation Suggestions - Remove `verify=False` and use certificate verification by default: ```python response = requests.post( args.url, data=args.data, headers=headers, proxies=proxies, timeout=15, ) ``` - Remove global suppression of `InsecureRequestWarning`. - If controlled testing of a self-signed endpoint is necessary, add an explicit `--insecure` option that defaults to false and emits a prominent warning when enabled. - Add support for a trusted custom CA bundle, such as `--ca-bundle /path/to/ca.pem`, and pass that path through the `verify` parameter. - Clearly identify insecure mode in the generated JSON output so downstream analysis cannot overlook the reduced trust level. - Avoid transmitting production credentials or session cookies when insecure mode is enabled. - Add tests confirming that untrusted certificates fail by default and that custom CA validation succeeds only when explicitly configured.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context Leakage

High

• Category: Data Exfiltration

Content

for pattern in error_patterns:
        match = re.search(pattern, text, re.IGNORECASE)
        if match:
            # Extract context around the error (200 chars before, 800 after)
            start = max(0, match.start() - 200)
            end = min(len(text), match.end() + 800)
            return f"...{text[start:end]}..."

• Confidence: 88% confidence
• Finding: The function extracts and returns substantial surrounding response content near matched error strings, which can expose sensitive server-side details such as stack traces, SQL fragments, filesystem paths, tokens, or application data. Because this skill is built to probe for vulnerability evidence, preserving and printing these snippets amplifies disclosure risk and may leak confidential data into logs, downstream tooling, or operators' consoles.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill performs live network actions against user-supplied targets and explicitly invokes a replay script, but it declares no tool or permission scope to constrain those capabilities. This creates a governance gap: the skill can be used to send arbitrary HTTP requests without clear enforcement boundaries, increasing the risk of misuse for unauthorized probing or replay of sensitive requests.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow instructs the agent to parse and retransmit sensitive headers such as Cookie and User-Agent along with attacker-controlled payloads, but it does not clearly warn users that authentication material and other secrets may be sent to a target system. This can lead to accidental credential leakage, session misuse, or unintended replay of privileged requests during validation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script is explicitly designed to replay attacker-controlled payloads to arbitrary targets, but it provides no confirmation, authorization check, scope restriction, or user-facing warning before transmitting those payloads. In a vulnerability-validation skill, this increases the chance of misuse against unintended or unauthorized systems and can facilitate active exploitation attempts rather than passive analysis.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

if args.method.upper() == "POST":
            if "Content-Type" not in headers:
                headers["Content-Type"] = "application/x-www-form-urlencoded"
            response = requests.post(args.url, data=args.data, headers=headers, verify=False, proxies=proxies, timeout=15)
        else:
            response = requests.get(args.url, params=args.data, headers=headers, verify=False, proxies=proxies, timeout=15)

• Confidence: 98% confidence
• Finding: The POST request disables TLS certificate verification with verify=False, allowing man-in-the-middle interception or modification of requests and responses. Since this tool transmits potentially sensitive payloads and collects diagnostic response data, disabled certificate validation can expose probe contents, credentials in headers, and returned evidence to network attackers.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

headers["Content-Type"] = "application/x-www-form-urlencoded"
            response = requests.post(args.url, data=args.data, headers=headers, verify=False, proxies=proxies, timeout=15)
        else:
            response = requests.get(args.url, params=args.data, headers=headers, verify=False, proxies=proxies, timeout=15)
            
        snippet = extract_error_snippet(response.text)

• Confidence: 98% confidence
• Finding: The GET request also disables TLS certificate verification with verify=False, creating the same man-in-the-middle risk for request parameters, headers, and captured response data. In this skill's context, GET parameters may contain replayed exploit strings or identifiers, so interception or tampering can both leak sensitive material and distort validation results.

Static analysis

No suspicious patterns detected.