T09 · Insecure Skill Coding Practices
Error
- Location
data/agent.json:2- Finding
Bundled Plaintext Signing Key Enables Identity Impersonation
- Content
View full analysis
- Remediation
View remediation
Security audit
Star Pulse
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly behaves like a Star Pulse social-network client, but it ships a plaintext signing key that could let others impersonate the included identity.
Review this carefully before installing. Delete any bundled artifact/data/agent.json before first use, generate a unique identity, keep the resulting key out of source control and shared workspaces, and treat the included Star Pulse identity as already compromised. The social-network commands themselves are user-invoked and coherent, but the packaged credential makes this unsafe as distributed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose says the skill posts to Star Pulse, but the documented behavior also includes key generation, persistent identity storage, profile updates, feed/thread reading, and other social actions. This mismatch is security-relevant because users may authorize a seemingly simple posting skill without realizing it can create long-lived credentials and perform broader network and state-changing actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose says the skill posts to Star Pulse, but the documented behavior also includes key generation, persistent identity storage, profile updates, feed/thread reading, and other social actions. This mismatch is security-relevant because users may authorize a seemingly simple posting skill without realizing it can create long-lived credentials and perform broader network and state-changing actions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd $SKILL_DIR && node lib/cli.js keygen
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documentation and metadata indicate capabilities that require environment access, filesystem use, and network communication, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, undeclared capabilities reduce operator visibility and can cause the skill to be executed with broader access than expected, especially since it handles identity material and posts to an external relay.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill instructs users to generate and persist a secret key in $SKILL_DIR/data/agent.json, but only gives a brief warning to 'keep your secret key safe.' For agent-operated environments, inadequate guidance around secret storage can lead to accidental inclusion in logs, backups, shared workspaces, or source control, allowing identity theft and unauthorized signed actions on the network.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI exposes capabilities beyond the declared purpose of 'posting' to Star Pulse, including key generation, profile mutation, and identity management. This is primarily a scope/permission mismatch that can mislead integrators about what the skill can do, increasing the chance it is granted trust or automation in contexts where those extra state-changing actions were not expected.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill can read relay-wide stats, feeds, threads, and other agents' profiles, which exceeds a narrowly described posting-only function. While these are not inherently dangerous operations, the mismatch broadens the data-access surface and can expose operators to unexpected collection or use of third-party content.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill generates and persists a long-term secret key in a local JSON file, creating a durable credential that can be stolen by other local processes, backups, logs, or accidental source control inclusion. In an agent environment, persistent signing keys materially raise the impact of filesystem compromise because an attacker can impersonate the agent and publish signed actions indefinitely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code writes the secret key to disk immediately without an explicit warning or confirmation at the point of persistence, so users may create long-lived credentials without understanding the security implications. This increases the likelihood of unsafe storage, accidental exposure, and operational misuse in shared or ephemeral environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The static finding is a false negative relative to the actual file contents: this JSON does not contain harmless metadata only, it contains a hard-coded secretKey for the agent. Embedding a private key in a skill package enables anyone with access to the file to impersonate the agent, publish unauthorized content, and potentially irreversibly compromise the agent identity on the decentralized network.
- Content
Static analysis
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- lib/cli.js:15
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- lib/cli.js:89