Security audit

Table Mountain Status

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its helper script and automation examples allow broader network, file-write, and scheduled messaging behavior than the stated Table Mountain status purpose requires.

Install only if you are comfortable with a skill that can make network requests, write local files, and optionally create a recurring Telegram reporting job. Prefer using the default official API URL, keep output under data/table-mountain, and review or remove any cron job after the alert period ends.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_status.py:25
Finding: Arbitrary URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
Dict[str, Any]: with request.urlopen(url, timeout=timeout) as resp: # noqa: S310 (trusted URL) return json.load(resp) ``` ```python parser.add_argument("--url", default=API_URL, help="API URL (default: %(default)s)") ``` ```python data = fetch_status(args.url, args.timeout) ``` ### Technical Analysis The command-line `--url` argument is passed directly to `urllib.request.urlopen()` without validating its scheme, host, port, resolved IP address, or path. The accompanying `# noqa` comment describes the URL as trusted, but the URL is caller-controlled. The Skill's declared functionality only requires access to the fixed official endpoint: ```text https://cms.tablemountain.net/admin/actions/submissions/default/weather-api ``` Permitting arbitrary URLs exceeds the minimum network privileges required for that functionality. Depending on the schemes supported by the runtime and the host's network access, a caller may direct the script to internal HTTP services, loopback interfaces, link-local services, cloud metadata endpoints, or local resources. Redirects can also undermine a superficial validation check unless every redirect destination is independently verified. The response must contain valid JSON for `json.load()` to succeed. Furthermore, normal output only exposes the predefined status fields. These constraints reduce exploitability but do not eliminate the SSRF primitive. ### Attack Path 1. An attacker influences instructions or arguments supplied to the Skill. 2. The attacker causes the agent to invoke the script with an attacker-selected URL, for example an internal JSON endpoint: ```bash python3 scripts/fetch_status.py \ --url htt ...[truncated 1058 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/fetch_status.py:49
Finding: Caller-Controlled Output Path Allows Arbitrary File Overwrite
Content: View full analysis
None: path.parent.mkdir(parents=True, exist_ok=True) if output_format == "json": payload = {key: data.get(key) for key in FIELDS} path.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8") else: path.write_text(format_summary(data) + "\n", encoding="utf-8") ``` ```python parser.add_argument( "--output", default="data/table-mountain/status.txt", help="Output path for summary or JSON", ) ``` ```python write_output(data, Path(args.output), args.format) ``` ### Technical Analysis The `--output` argument accepts an arbitrary filesystem path. The script creates missing parent directories and calls `Path.write_text()`, which truncates and replaces an existing target. It does not confine output to the intended `data/table-mountain` directory, reject path traversal or absolute paths, inspect symlinks, or prevent overwriting existing files. The declared functionality only requires writing status data beneath a dedicated application data directory. Allowing writes anywhere permitted by the process therefore exceeds the minimum filesystem access required. The written content is restricted to the fetched status fields or their formatted representation, which limits content control. Nevertheless, replacing a writable configuration, state, report, or script file with JSON or text can cause denial of service or alter downstream behavior. ### Attack Path 1. An attacker influences the command-line arguments used to invoke the Skill. 2. The attacker selects a sensitive path writable by the agent: ```bash python3 scripts/fetch_status.py \ --output /path/to/writ ...[truncated 966 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises network access and file-writing behavior in its instructions but does not declare any explicit tool scope or permissions boundary. This can cause the agent to invoke broader capabilities than intended, increasing the chance of unauthorized network requests or filesystem writes if the skill is auto-selected or reused in another context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest description includes broad activation language such as use when the user asks for general updates, alerts, or automated Telegram reports, which may match ordinary requests too loosely. Over-broad triggering can cause the wrong skill to activate and perform network calls, file writes, or scheduling actions in situations the user did not specifically intend.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: Most of the skill instructions and user-facing descriptions are written in German, including headings and operational guidance, with no indication that the user may choose another language. That can violate language or locale policy when a skill implicitly constrains interaction language without documenting opt-in or a justified locale requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script hard-codes German user-facing text such as "unbekannt", "Letztes Update", and weather/status labels in its output. This enforces a specific language/locale for all users without offering a choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.