T08 · Insecure Dependencies
Warning
- Location
SKILLS.md:110- Finding
Unpinned Remote Dependencies and Dynamically Selected SDK Source
- Content
View full analysis
- Remediation
View remediation
Security audit
Create Mcp App
Security checks for vulnerabilities and agentic risk
Overview
The package is not clearly malicious, but it mixes unrelated artifacts and asks agents to use unpinned remote code and under-hardened API-proxy patterns.
Review before installing. Use this only in a disposable or well-contained workspace, pin npm dependencies and remote references before running setup commands, and do not expose the sample /api/chat proxy publicly unless you add authentication, rate limits, request validation, logging redaction, and spending controls. Confirm that the unrelated Velclaw, Terraform, OpenShift, and curl artifacts are intentional before trusting the package as a focused skill.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:67- Finding
Credential-Backed Proxy Example Lacks Authentication and Abuse Controls
- Content
View full analysis
{ const r = await fetch('https://api.example-provider.com/v1/messages', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.THIRD_PARTY_API_KEY}` }, body: JSON.stringify(req.body) }); res.json(await r.json()); }); ``` ### Technical Analysis The example exposes an `/api/chat` endpoint that accepts an arbitrary request body and forwards it to a third-party service while attaching the server owner's API credential. It does not demonstrate: - Client authentication. - Per-user authorization. - Rate limiting or usage quotas. - Request schema validation. - Request-body size limits. - Upstream timeouts or cancellation. - Restricted CORS or network exposure. - Safe handling of upstream errors. The credential is correctly kept in a server-side environment variable and is not sent to the browser. The flagged `fetch` in `index.tsx` is contained inside a string rendered by `CodeBlock`; it is not executed by the included React component. The security issue is therefore not direct credential exfiltration by the audited frontend. Instead, the documentation presents a credential-bearing proxy that becomes abusable if copied into a reachable server without additional controls. The destination is a placeholder domain, so the example does not establish transmission to an attacker-controlled endpoint. The weakness arises when a real provider URL and credential are configured. ### Attack Path 1. A developer copies the documented endpoint into a Node.js backend and replaces the placeholder provider URL with a real AI API. 2. The backend is exposed to a network without adding authent ...[truncated 1339 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (25)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
git clone https://github.com/Velclaw/Velclaw.git cd Velclaw npm install cp .env.example .env # điền API key của bạn npm run dev
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
git clone https://github.com/Velclaw/Velclaw.git cd Velclaw npm install cp .env.example .env # điền API key của bạn npm run dev
text
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </header> <!-- ============ HERO (merged from trang chủ developer.hashicorp.com) ============ --> <section class="hero" id="hero"> <div> <div class="hero-eyebrow"><span class="dot"></span> Terraform CLI · Tutorial trực tiếp</div>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
tsx ]; const TECH_BADGES = [ "Node.js", "Anthropic API", "GitHub", "VS Code", "JetBrains Mono", ".env", "REST", "Claude", "Express", ];
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
tsx ]; const TECH_BADGES = [ "Node.js", "Anthropic API", "GitHub", "VS Code", "JetBrains Mono", ".env", "REST", "Claude", "Express", ];
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
tsx ]; const TECH_BADGES = [ "Node.js", "Anthropic API", "GitHub", "VS Code", "JetBrains Mono", ".env", "REST", "Claude", "Express", ];
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README mandates logging for every request but does not warn that AI prompts, responses, headers, or third-party payloads may contain sensitive user data or secrets. In an agent platform that proxies user content to external AI providers, indiscriminate logging can create a secondary data-exposure path through logs, retention systems, and operator access.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js app.post('/api/chat', async (req, res) => { const r = await fetch('https://api.example-provider.com/v1/messages', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.THIRD_PARTY_API_KEY}` }, body: JSON.stringify(req.body)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
tsx ```js app.post('/api/chat', async (req, res) => { const r = await fetch('https://api.example-provider.com/v1/messages', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.THIRD_PARTY_API_KEY}` }, body: JSON.stringify(req.body)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js app.post('/api/chat', async (req, res) => { const r = await fetch('https://api.example-provider.com/v1/messages', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.THIRD_PARTY_API_KEY}` }, body: JSON.stringify(req.body)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js app.post('/api/chat', async (req, res) => { const r = await fetch('https://api.example-provider.com/v1/messages', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.THIRD_PARTY_API_KEY}` }, body: JSON.stringify(req.body)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
tsx ```js app.post('/api/chat', async (req, res) => { const r = await fetch('https://api.example-provider.com/v1/messages', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.THIRD_PARTY_API_KEY}` }, body: JSON.stringify(req.body)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js app.post('/api/chat', async (req, res) => { const r = await fetch('https://api.example-provider.com/v1/messages', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.THIRD_PARTY_API_KEY}` }, body: JSON.stringify(req.body)
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
bash npm install -D tsx npm pkg set scripts.dev="cross-env NODE_ENV=development concurrently 'cross-env INPUT=mcp-app.html vite build --watch' 'tsx --watch main.ts'"[!NOTE]
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The HTML document declares
lang="vi", and the visible navigation and tutorial content are written in Vietnamese throughout the page, which effectively fixes the skill experience to a specific language. The file does not indicate that this is an optional locale, provide a language switch, or document a region-specific justification for the restriction.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code embeds navigation and broader interface copy in a single language, and the rest of the file continues that pattern throughout the UI. Under the policy rules, forcing a specific language without user opt-in is a natural-language locale policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README explicitly promotes logging every request as mandatory but does not warn about excluding prompts, personal data, credentials, session tokens, or model outputs from logs. In an AI workspace that brokers many agents and user interactions, indiscriminate request logging can create a secondary sensitive-data store that increases breach impact and privacy/compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example backend forwards the entire request body to a third-party AI provider without any notice about external data transfer, minimization, or consent. In this context, agent prompts and uploaded content may contain confidential or regulated data, so documenting blind forwarding can lead adopters to transmit sensitive information off-platform without appropriate safeguards.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user-facing labels, feature descriptions, FAQ, and other interface text are written entirely in Vietnamese, and the file does not indicate that the skill is intentionally region-specific or that users can opt into another language. This creates a natural-language locale policy issue because the experience appears to force a specific language by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language instructions and descriptions in this file are all in Vietnamese, with no indication that users can choose another language or that the project is intentionally limited to a Vietnamese-speaking audience. Per the policy, forcing a specific language without opt-in is a locale/language policy concern.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md You can choose to also install additional operators that are recommended for the use of certain OpenShift AI features. If they are not already installed on your cluster, you can choose to include them in the add-on installation. Or, you can install them at anytime by using OperatorHub or by following the operator-specific installation steps. To use these operators, you must [disable outbound traffic protection](https://cloud.ibm.com/docs/openshift?topic=openshift-sbd-allow-outbound&format=markdown) for your cluster. You are responsible for managing these operators, including but not limited to updating, monitoring, recovery, and re-installation. {: important} The following operators are recommended.
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md You can choose to also install additional operators that are recommended for the use of certain OpenShift AI features. If they are not already installed on your cluster, you can choose to include them in the add-on installation. Or, you can install them at anytime by using OperatorHub or by following the operator-specific installation steps. To use these operators, you must [disable outbound traffic protection](https://cloud.ibm.com/docs/openshift?topic=openshift-sbd-allow-outbound&format=markdown) for your cluster. You are responsible for managing these operators, including but not limited to updating, monitoring, recovery, and re-installation. {: important} The following operators are recommended.
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md You can choose to also install additional operators that are recommended for the use of certain OpenShift AI features. If they are not already installed on your cluster, you can choose to include them in the add-on installation. Or, you can install them at anytime by using OperatorHub or by following the operator-specific installation steps. To use these operators, you must [disable outbound traffic protection](https://cloud.ibm.com/docs/openshift?topic=openshift-sbd-allow-outbound&format=markdown) for your cluster. You are responsible for managing these operators, including but not limited to updating, monitoring, recovery, and re-installation. {: important} The following operators are recommended.
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md You can choose to also install additional operators that are recommended for the use of certain OpenShift AI features. If they are not already installed on your cluster, you can choose to include them in the add-on installation. Or, you can install them at anytime by using OperatorHub or by following the operator-specific installation steps. To use these operators, you must [disable outbound traffic protection](https://cloud.ibm.com/docs/openshift?topic=openshift-sbd-allow-outbound&format=markdown) for your cluster. You are responsible for managing these operators, including but not limited to updating, monitoring, recovery, and re-installation. {: important} The following operators are recommended.
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The inline comment states that the GIF represents an actual execution rather than a mockup screenshot. In the code shown, this is only a hardcoded base64 string assigned to a constant, so the documentation asserts provenance that the code does not establish or verify.
- Content