Security audit

Malaysian Business Lookup (SSM)

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised company lookup, but it also charges a supplied user ID on each request with limited authorization and network-scope disclosure.

Review this skill carefully before installing. It appears intended to be a paid Malaysian company lookup, but hosts should require explicit user consent for each charge, bind billing to authenticated user context rather than a raw user_id, and disclose or constrain the SSM and SkillPay network endpoints.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims to perform company-data lookup, but it also introduces external billing behavior and processes user identity information not clearly disclosed in the main description or permissions model. This mismatch is dangerous because users or hosting agents may invoke the skill expecting a simple lookup while unintentionally triggering payment flows or sending billing-related identifiers to third parties.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill metadata does not declare any tool scope or allowed network capability, yet the skill necessarily relies on external network access to query SSM data and potentially billing infrastructure. Undeclared external access reduces transparency and prevents hosts or users from applying least-privilege controls, which can enable unexpected data transmission or misuse of network-capable execution.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code declares access to a billing API key and uses it to invoke charging behavior even though the skill description only mentions looking up SSM company data. Access to payment credentials expands the skill’s capability beyond its advertised purpose, increasing the risk of unauthorized charges or abuse if the skill is invoked in contexts where users expect a read-only lookup.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill’s stated purpose is a company-data lookup, but the handler charges the user before performing the lookup. That introduces a payment side effect unrelated to the narrowly described functionality, creating a risk of undisclosed or unexpected billing and violating least-privilege/least-surprise expectations for a lookup skill.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The handler attempts to charge the user immediately based on the supplied user_id, with no evidence in this file of user-facing notice, confirmation, or proof of authorization. In a lookup skill, silent charging is especially risky because users may treat the action as informational and not expect a financial side effect.

Static analysis

No suspicious patterns detected.