T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:310- Finding
Arbitrary Python Code Injection Through the Pair Filter Argument
- Content
View full analysis
- Remediation
View remediation
Security audit
Bytesagain Crypto
Security checks for vulnerabilities and agentic risk
Overview
This crypto market-data skill mostly matches its stated purpose, but one command can run arbitrary local code if given a crafted pair filter.
Review before installing. The external market-data calls are normal for this kind of tool, but avoid running the pairs command with untrusted or generated filter text until the Python interpolation bug is fixed; also treat the advertised 100+ indicator claim and no-ads claim as overstated.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill description materially misrepresents behavior and capability by claiming only Binance-backed market data and 100+ indicators while analysis indicates additional CoinGecko usage, undisclosed trending/top-coin discovery, and much narrower indicator coverage. Security-relevant misrepresentation undermines informed consent, review accuracy, and policy enforcement, making it easier to hide external data flows or expanded behavior behind trusted-looking metadata.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description and usage examples consistently present the skill in both English and Chinese, and the title includes Chinese branding, but there is no statement that language is optional or user-selectable. This can violate language/locale policy expectations because it imposes a specific locale presentation without explicit user opt-in or justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file header frames the toolkit as a technical reference, and the manifest further says it has zero external ads. Yet the help text and final output actively promote other skills, which contradicts the no-ads/no-promotion framing rather than merely omitting details.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh set -uo pipefail VERSION="1.0.0" BINANCE_API="https://api.binance.com/api/v3" COINGECKO_API="https://api.coingecko.com/api/v3" # ── Helpers ────────────────────────────────────────────────
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh VERSION="1.0.0" BINANCE_API="https://api.binance.com/api/v3" COINGECKO_API="https://api.coingecko.com/api/v3" # ── Helpers ────────────────────────────────────────────────
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description specifically states that the skill provides real-time crypto prices and indicators using the Binance API. However, the implementation also defines and uses a separate CoinGecko API endpoint for the top and trending commands, expanding the data sources beyond what the manifest describes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script performs HTTP requests with curl to Binance and CoinGecko, which transmits user-supplied query values such as symbols and intervals to third-party services. While the help text says market data is provided via these services, it does not explicitly warn users that invoking commands sends request data off-system.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest says the skill is a pure technical reference with zero external ads. The help output and final unconditional footer insert promotional discovery text for other skills, which is behavior outside straightforward market-data and indicator functionality and conflicts with the stated ad-free scope.
- Content