T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bellwire.mjs:238- Finding
Management bearer tokens can be transmitted to an untrusted API origin
- Content
View full analysis
- Remediation
View remediation
Security audit
Bellwire
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Bellwire notification purpose, but review is warranted because bearer tokens can be sent to an unvalidated API URL when the endpoint is overridden.
Install only if you trust Bellwire and can keep the API endpoint configuration under your control. Before using it, lock BELLWIRE_API_URL to the official Bellwire origin or a trusted HTTPS self-hosted origin, keep all Bellwire tokens in a real secret manager, and require explicit confirmation for delete, revoke, mode-change, and token-creation operations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/examples/node/private-direct.mjs:60- Finding
Private wake token can be forwarded to an arbitrary caller-supplied endpoint
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md re, timestamp, unknown key, tampered target, and atomic nonce replay; then run `conformance-direct.mjs`. If the database cannot atomically consume a nonce, stop
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use [scripts/bellwire.mjs](scripts/bellwire.mjs) for API operations. It defaults to the official hosted API and accepts `BELLWIRE_API_URL` for self-hosted insta
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Read [adapters.md](references/adapters.md) for Node.js, Cloudflare Worker, Shell, and GitHub Actions patterns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md file after successful import. - Give each project its own mode-specific runtime token. Never reuse a wake or Ingest Token across repositories. - Treat email, phone, name, IP address, customer ID, access token, and free-form user content as sensitive unless the user says otherwise. - Private is the default. Bellwire receives only an encrypted connection envelope and a random opaque wake reference; the App pulls notification, Inbox, and Surface content from the user's service with a signed request.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to access environment secrets and perform networked API operations, but it does not declare an explicit tool/permission scope such as allowed-tools or permissions. This creates an authority mismatch: a caller cannot easily tell that the skill may read secrets and make external requests, increasing the risk of unintended secret exposure or unauthorized outbound actions if the skill is invoked in a permissive runtime.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts await fetch( `https://api.bellwire.app/v1/projects/${projectId}/private-wakes`, { method: "POST", signal: AbortSignal.timeout(5_000),
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts await fetch( `https://api.bellwire.app/v1/projects/${projectId}/private-wakes`, { method: "POST", signal: AbortSignal.timeout(5_000),
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts await fetch( `https://api.bellwire.app/v1/projects/${projectId}/private-wakes`, { method: "POST", signal: AbortSignal.timeout(5_000),
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts await fetch( `https://api.bellwire.app/v1/projects/${projectId}/private-wakes`, { method: "POST", signal: AbortSignal.timeout(5_000),
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Hosted Shell
bash curl --fail-with-body --silent --show-error \ --max-time 5 \ --request POST \ --header "Authorization: Bearer ${BELLWIRE_INGEST_TOKEN:?missing}" \
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md 2. Verify the signature and timestamp before parsing or trusting any field. 3. Return a stable provider event ID and provider event time. 4. Reject invalid signatures without calling Bellwire. 5. Ignore unsupported event types with a successful response so providers do not retry forever. Use the provider's official verification library when the project already uses it or when the signature algorithm is easy to implement incorrectly. Never
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The function performs a network POST to an external Bellwire API and includes a bearer token in the Authorization header. Although the function name and code make the purpose clear to a developer, this file does not include any user-facing warning, prompt, or disclosure comment that the skill transmits data and credentials off-host.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/bellwire.mjs:152
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/conformance-direct.mjs:232