T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:340- Finding
Client-Controlled User Identity Permits Unauthorized Premium Operations
- Content
View full analysis
- Remediation
View remediation
Security audit
Teamgram RPC Development
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only RPC development skill, but its examples include unsafe payment, authorization, secret-handling, and logging patterns that could be copied into production.
Review this skill before installing or using it as a coding reference. It is not an active malware-like package, but developers should not copy the premium payment, authorization, logging, Vault, or secret-loading examples without adding authenticated identity checks, verified payment callbacks, transaction/idempotency handling, redaction, endpoint validation, and path traversal protections.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:283- Finding
Premium Entitlement Is Granted Without Verified Payment
- Content
View full analysis
- Remediation
View remediation
paid -> fulfilled`, and reject invalid or repeated transitions. - Add tests for failed payment, altered amount, replayed callback, duplicate callback, timeout, and partial database failure. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
references/v1.3.0-security.md:304- Finding
Vault Token Can Be Transmitted to a Caller-Controlled or Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/v1.3.0-security.md:333- Finding
Secret Name Is Used in a Filesystem Path Without Traversal Protection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/v1.1.0-error-handling.md:145- Finding
Logging Examples Expose Complete Requests and Private Message Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/v1.3.0-security.md:180- Finding
CSRF Referer Validation Can Be Bypassed With a Prefix-Matching Domain
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The markdown mixes English headings with substantial instructional content presented only in Chinese, including the highlighted version note and navigation items. This imposes a language choice on users without offering an alternative or opt-in, which matches the language/locale policy violation criteria.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This is a true issue: the guide’s primary implementation demonstrates unsafe patterns that it later explicitly labels as 'Wrong', including ignored errors (
_ = ...), fire-and-forget async payment processing, and lack of context propagation/cancellation handling. Because this is a development skill intended to be copied by engineers, these contradictions can directly propagate reliability and security flaws into production payment and entitlement code.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This is a real vulnerability pattern: the purchase flow records a transaction and later activates premium status without a transaction boundary or compensating mechanism, despite the guide later recommending atomic operations. In payment/entitlement logic, partial failure can leave inconsistent state, such as successful activation without confirmed payment or stuck pending transactions, enabling fraud, support burden, and accounting errors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The examples normalize logging user IDs, request data, and related sensitive fields without warning about privacy implications or safe-handling requirements. In a developer guidance skill, omission of those warnings is risky because readers are likely to treat the examples as approved patterns and replicate privacy-invasive logging broadly.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The logging guidance includes recording full request data via
req.String(), which can easily capture message bodies, identifiers, tokens, or other sensitive fields. In an error-handling/logging best-practices document, demonstrating broad request logging normalizes over-collection and can lead downstream developers to persist sensitive data into logs, increasing privacy and incident-response risk.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The business-operation example logs
message_preview, which directly encourages logging user-generated content. Even partial message content may contain secrets, personal information, or regulated data, so this example can cause widespread sensitive-data leakage if copied into production services.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents its title and surrounding instructional content in Chinese only, and there is no visible opt-in, alternative language, or justification that the skill is region-specific. That can violate a language/locale policy requiring user choice rather than forcing a specific language by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file title and all instructional content are presented in Chinese, with no indication that other languages are supported or that the locale is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing instructional content in Chinese, including headings and code-context descriptions, but does not indicate that the skill is region- or language-specific or offer an opt-in language choice. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document title, headings, comments, and examples are all presented in Chinese, and there is no indication that users can opt into another language or that the file is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example claims to enforce tenant isolation automatically, but it does so by blindly appending
WHERE tenant_id = ?to any query string. This can produce invalid SQL when the original query already containsWHERE,ORDER BY,LIMIT, joins, or subqueries, and it can also give developers a false sense that tenant isolation is reliably enforced when it is not. In a multi-tenant RPC development guide, misleading isolation examples are security-relevant because they may be copied into production code and lead to cross-tenant data exposure or broken access controls.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's natural-language instructions and headings are entirely in Chinese, which effectively forces a specific language for readers without any opt-in or explanation. Under the stated policy, language constraints should either offer a choice or be clearly justified as region-specific.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The tracing example logs client IP addresses even though IPs are not necessary to illustrate trace propagation. IP addresses are personal data in many environments, and adding them to standard request logs increases privacy exposure and data-retention obligations without a clear operational need in this documentation context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents its instructions and examples entirely in Chinese, beginning with the title and section headings, with no indication that the user can choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file title and all instructional content are presented in Chinese, which imposes a specific language choice in natural-language content. The file does not indicate that language selection is optional or that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The heading is entirely in Chinese ("数据库优化"), which indicates a language-specific presentation without any visible user choice or justification in the file. The policy explicitly flags language or locale constraints when they are imposed without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file uses Chinese headings and labels throughout, such as the title and section names, but does not indicate that the skill is region-specific or provide any user language choice. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.
- Content