This skill attempts to harvest API tokens, executes
Claims to do
Create Application Skill: **YOU ARE THE EXECUTOR** - This skill contains the complete workflow that you must execute directly. When invoked:
Actually does
The skill uses `mcp__perplexity-aicore__perplexity_search` and `WebFetch` to gather information about an application from various web sources and the application's website. It then processes this data, performs quality checks, and uses an embedded Python script to authenticate with LeanIX via OAuth2 and interact with its GraphQL API to create or update an application fact sheet. For multiple applications, it spawns subagents using the `Task` tool.
The skill creates directories using a user-controlled application name (`[App_Name]`), which could be exploited for path traversal attacks to create directories in arbitrary locations.
mkdir -p ../executions/[App_Name]
The skill explicitly instructs the agent to spawn sub-agents via the Task tool when multiple applications are requested. The sub-agent prompt instructs the spawned agent to read a skill file from a local path and execute its full workflow, meaning whoever controls the skill file at that path controls the sub-agent's behavior. This is a classic attacker-controlled prompt injection vector via sub-agent spawning.
Task(
subagent_type="general-purpose",
description="Create LeanIX application for {App}",
prompt="Read the SKILL.md at /Users/I756819/.claude/plugins/cache/leanix-catalog-research-marketplace/create-application/1.0.0/skills/create-application/skill/SKILL.md and execute the full 4-step workflow to create a LeanIX Application fact sheet for: {App}"
)A hardcoded absolute filesystem path containing a specific username ('I756819') is embedded in the skill. This leaks the identity of the developer/user and ties the skill to a specific machine, which could be exploited to enumerate the filesystem or target the specific user account.
/Users/I756819/.claude/plugins/cache/leanix-catalog-research-marketplace/create-application/1.0.0/skills/create-application/skill/SKILL.md
The skill instructs the agent to execute 'echo $LEANIX_API_TOKEN' to check for the presence of the API token. This causes the agent to read and expose a sensitive credential from the environment. The token value starting with 'LXT_' is also referenced, providing a pattern for credential identification. The Python script then directly reads and uses this token for authenticated API calls.
check with `echo $LEANIX_API_TOKEN` ... API_TOKEN = os.environ['LEANIX_API_TOKEN'] ... If still missing, ask user for token (starts with 'LXT_').
The skill instructs the agent to execute an inline Python script via a bash heredoc (python3 << 'PYEOF'). The script performs network authentication, GraphQL mutations, and filesystem operations. The placeholder values (e.g., {appName}, {description}) are interpolated directly into the script without sanitization, creating a code injection risk if the research phase returns malicious data containing shell/Python metacharacters.
```bash
python3 << 'PYEOF'
import urllib.request, urllib.parse, json, ssl, base64, os
API_TOKEN = os.environ['LEANIX_API_TOKEN']
SUBDOMAIN = os.environ['LEANIX_SUBDOMAIN']
...
APP_NAME = "{appName}"
...
PYEOF
```The skill instructs the agent to create directories and write files to the local filesystem as part of its normal workflow. This creates persistent artifacts that could be used for data exfiltration staging or to persist information across agent sessions.
```bash mkdir -p ../executions/[App_Name] ``` Save outputs: - `final_fields.json` - Verified data ready for LeanIX - `COMPLETION_REPORT.md` - Full research summary - `parallel_research.json` - Raw research data (optional)
The error handling section instructs the agent to execute 'source ~/.zshrc' to retrieve credentials. Sourcing shell profile files executes all commands contained within them, which is a dangerous pattern that could execute arbitrary commands if the profile has been tampered with.
Action: Source ~/.zshrc first: source ~/.zshrc python3 << 'PYEOF' ...
The skill constructs WebFetch URLs based on user-provided application names or URLs. If the user provides an internal hostname, localhost address, or cloud metadata endpoint (e.g., 169.254.169.254) as the 'application URL', the agent will fetch it, potentially exposing internal services or cloud instance metadata.
"Create an application entry for [website URL]" ... WebFetch(url="https://[app-domain]", prompt="Extract: name, description, type indicators, hosting info, SSO mentions")
The skill explicitly instructs the agent to ask the user for the LEANIX_API_TOKEN if it's not found in the environment, which is a direct attempt to harvest sensitive credentials from the human overseer.
If still missing, ask user for token (starts with 'LXT_').
The skill explicitly states 'YOU ARE THE EXECUTOR' and 'DO NOT delegate the entire workflow to a 'application-creator' subagent' for single applications. However, it then mandates spawning subagents using the `Task` tool for multiple applications, directly contradicting its own core instruction against delegation.
The skill states: '❌ DO NOT delegate the entire workflow to a 'application-creator' subagent' and 'Single app: Execute the 4-step workflow yourself (YOU ARE THE EXECUTOR).' but also 'Multiple apps: Spawn parallel subagents, one per app, all in one message.' and 'Immediately spawn one subagent per application using the Task tool'.
The skill description uses very broad trigger phrases ('application data collection', 'app catalog management', 'application research') that could cause the agent to invoke this skill in contexts where the user did not intend to create applications, execute Python scripts, or make authenticated API calls to LeanIX.
Also trigger when user mentions application data collection, application research, or app catalog management. This skill automates the entire workflow - always use it rather than doing ad-hoc research.
The skill fetches content from arbitrary web pages (homepage, /security, /pricing, /about, /changelog) and instructs the agent to extract data from them. A malicious website operator could embed prompt injection instructions in their page content that would be processed by the agent as instructions, potentially hijacking the workflow steps or exfiltrating data.
WebFetch(url="https://[app-domain]", prompt="Extract: name, description, type indicators, hosting info, SSO mentions") WebFetch(url="https://[app-domain]/security", prompt="Extract: SSO support, authentication methods, security features") WebFetch(url="https://[app-domain]/pricing", prompt="Extract: pricing model, tiers, features by plan") WebFetch(url="https://[app-domain]/about", prompt="Extract: company background, former names, aliases") WebFetch(url="https://[app-domain]/changelog", prompt="Extract: SSO announcements, major features, hosting updates")
Research results from Perplexity and WebFetch are directly interpolated as string placeholders into a Python script that is then executed. A malicious web page or Perplexity result could contain characters or sequences that break out of the string context in the Python heredoc and inject arbitrary code (e.g., closing quotes, newlines with Python statements).
fields = {
'/description': "{description}",
'/webpageUrl': "{webpageUrl}",
'/hostingType': "{hostingType}",
'/hostingDescription':"{hostingDescription}",
'/ssoStatus': "{ssoStatus}",
'/pricingUrl': "{pricingUrl}",
'/pricingType': "{pricingType}",
'/productCategory': "{productCategory}",The agent is instructed to reference local guideline files for decision-making, which could lead to cognitive state manipulation or RAG poisoning if the content of these files is untrusted or can be altered.
Reference: ../guidelines/Application_Product_Category_Guidelines.md (top 50 categories listed)
The skill instructs the agent to execute GraphQL mutations that create and modify records in a production LeanIX system without requiring user confirmation before the API call. The workflow is designed to proceed automatically through all 4 steps, only reporting success after data has already been written to the external system.
updateFactSheet(id: $id, patches: $patches, validateOnly: false) ... Status: Ready for review team approval ... Your role: Execute the 4-step workflow directly
[](https://mondoo.com/ai-agent-security/skills/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application)<a href="https://mondoo.com/ai-agent-security/skills/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application"><img src="https://mondoo.com/ai-agent-security/api/badge/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.