100Critical
This skill attempts to harvest API tokens, executes
Behavior Analysis
Mismatch detected — The skill explicitly states 'YOU ARE THE EXECUTOR' and 'DO NOT delegate the entire workflow to a 'application-creator' subagent' for single applications. However, it then mandates spawning subagents using the `Task` tool for multiple applications, directly contradicting its own core instruction against delegation.
Claims to do
Create Application Skill: **YOU ARE THE EXECUTOR** - This skill contains the complete workflow that you must execute directly. When invoked:
Actually does
The skill uses `mcp__perplexity-aicore__perplexity_search` and `WebFetch` to gather information about an application from various web sources and the application's website. It then processes this data, performs quality checks, and uses an embedded Python script to authenticate with LeanIX via OAuth2 and interact with its GraphQL API to create or update an application fact sheet. For multiple applications, it spawns subagents using the `Task` tool.
Skill Info
Namevineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application
Registrygithub
Version772b83dcef9d
PURLpkg:github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace@772b83dcef9d?skill=create-application
Source
SHA-256c9bea03798f5...
SHA-14abb777fccf0...
MD5072b5549330d...
TLSH10921ab76841...
ssdeep384:6nfUeNVc...
Size19,636 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Assessments (6)
AI Agent Traps ↗Directory Creation with Path Traversal Riskmediumcommand execution
The skill creates directories using a user-controlled application name (`[App_Name]`), which could be exploited for path traversal attacks to create directories in arbitrary locations.
80% confidenceline 507
mkdir -p ../executions/[App_Name]
Sub-agent spawning with attacker-controlled promptshighsub agent spawning
The skill explicitly instructs the agent to spawn sub-agents via the Task tool when multiple applications are requested. The sub-agent prompt instructs the spawned agent to read a skill file from a local path and execute its full workflow, meaning whoever controls the skill file at that path controls the sub-agent's behavior. This is a classic attacker-controlled prompt injection vector via sub-agent spawning.
90% confidenceline 62
Task(
subagent_type="general-purpose",
description="Create LeanIX application for {App}",
prompt="Read the SKILL.md at /Users/I756819/.claude/plugins/cache/leanix-catalog-research-marketplace/create-application/1.0.0/skills/create-application/skill/SKILL.md and execute the full 4-step workflow to create a LeanIX Application fact sheet for: {App}"
)Hardcoded user home path leaks PII/usernamemediumhardcoded secrets
A hardcoded absolute filesystem path containing a specific username ('I756819') is embedded in the skill. This leaks the identity of the developer/user and ties the skill to a specific machine, which could be exploited to enumerate the filesystem or target the specific user account.
95% confidenceline 63
/Users/I756819/.claude/plugins/cache/leanix-catalog-research-marketplace/create-application/1.0.0/skills/create-application/skill/SKILL.md
API token harvesting via environment variable accesshighcredential theft
The skill instructs the agent to execute 'echo $LEANIX_API_TOKEN' to check for the presence of the API token. This causes the agent to read and expose a sensitive credential from the environment. The token value starting with 'LXT_' is also referenced, providing a pattern for credential identification. The Python script then directly reads and uses this token for authenticated API calls.
85% confidenceline 421
check with `echo $LEANIX_API_TOKEN` ... API_TOKEN = os.environ['LEANIX_API_TOKEN'] ... If still missing, ask user for token (starts with 'LXT_').
Arbitrary Python code execution via shell heredoccriticalcommand execution
The skill instructs the agent to execute an inline Python script via a bash heredoc (python3 << 'PYEOF'). The script performs network authentication, GraphQL mutations, and filesystem operations. The placeholder values (e.g., {appName}, {description}) are interpolated directly into the script without sanitization, creating a code injection risk if the research phase returns malicious data containing shell/Python metacharacters.
90% confidenceline 195
```bash
python3 << 'PYEOF'
import urllib.request, urllib.parse, json, ssl, base64, os
API_TOKEN = os.environ['LEANIX_API_TOKEN']
SUBDOMAIN = os.environ['LEANIX_SUBDOMAIN']
...
APP_NAME = "{appName}"
...
PYEOF
```Filesystem write operations creating persistent artifactsmediumpersistence
The skill instructs the agent to create directories and write files to the local filesystem as part of its normal workflow. This creates persistent artifacts that could be used for data exfiltration staging or to persist information across agent sessions.
65% confidenceline 318
```bash mkdir -p ../executions/[App_Name] ``` Save outputs: - `final_fields.json` - Verified data ready for LeanIX - `COMPLETION_REPORT.md` - Full research summary - `parallel_research.json` - Raw research data (optional)
Source ~/.zshrc execution for credential retrievalmediumcommand execution
The error handling section instructs the agent to execute 'source ~/.zshrc' to retrieve credentials. Sourcing shell profile files executes all commands contained within them, which is a dangerous pattern that could execute arbitrary commands if the profile has been tampered with.
80% confidenceline 300
Action: Source ~/.zshrc first: source ~/.zshrc python3 << 'PYEOF' ...
SSRF risk via user-controlled URL in WebFetchmediumssrf
The skill constructs WebFetch URLs based on user-provided application names or URLs. If the user provides an internal hostname, localhost address, or cloud metadata endpoint (e.g., 169.254.169.254) as the 'application URL', the agent will fetch it, potentially exposing internal services or cloud instance metadata.
72% confidenceline 114
"Create an application entry for [website URL]" ... WebFetch(url="https://[app-domain]", prompt="Extract: name, description, type indicators, hosting info, SSO mentions")
Credential Harvesting from Userhighcredential harvesting
The skill explicitly instructs the agent to ask the user for the LEANIX_API_TOKEN if it's not found in the environment, which is a direct attempt to harvest sensitive credentials from the human overseer.
100% confidenceline 421
If still missing, ask user for token (starts with 'LXT_').
Description Mismatchhighdescription mismatch
The skill explicitly states 'YOU ARE THE EXECUTOR' and 'DO NOT delegate the entire workflow to a 'application-creator' subagent' for single applications. However, it then mandates spawning subagents using the `Task` tool for multiple applications, directly contradicting its own core instruction against delegation.
85% confidence
The skill states: '❌ DO NOT delegate the entire workflow to a 'application-creator' subagent' and 'Single app: Execute the 4-step workflow yourself (YOU ARE THE EXECUTOR).' but also 'Multiple apps: Spawn parallel subagents, one per app, all in one message.' and 'Immediately spawn one subagent per application using the Task tool'.
Skill description triggers broader than declared behaviorlowdescription mismatch
The skill description uses very broad trigger phrases ('application data collection', 'app catalog management', 'application research') that could cause the agent to invoke this skill in contexts where the user did not intend to create applications, execute Python scripts, or make authenticated API calls to LeanIX.
60% confidenceline 3
Also trigger when user mentions application data collection, application research, or app catalog management. This skill automates the entire workflow - always use it rather than doing ad-hoc research.
Prompt injection via researched web contenthighprompt injection
The skill fetches content from arbitrary web pages (homepage, /security, /pricing, /about, /changelog) and instructs the agent to extract data from them. A malicious website operator could embed prompt injection instructions in their page content that would be processed by the agent as instructions, potentially hijacking the workflow steps or exfiltrating data.
88% confidenceline 117
WebFetch(url="https://[app-domain]", prompt="Extract: name, description, type indicators, hosting info, SSO mentions") WebFetch(url="https://[app-domain]/security", prompt="Extract: SSO support, authentication methods, security features") WebFetch(url="https://[app-domain]/pricing", prompt="Extract: pricing model, tiers, features by plan") WebFetch(url="https://[app-domain]/about", prompt="Extract: company background, former names, aliases") WebFetch(url="https://[app-domain]/changelog", prompt="Extract: SSO announcements, major features, hosting updates")
Unsanitized research data injected into executed codehighprompt injection
Research results from Perplexity and WebFetch are directly interpolated as string placeholders into a Python script that is then executed. A malicious web page or Perplexity result could contain characters or sequences that break out of the string context in the Python heredoc and inject arbitrary code (e.g., closing quotes, newlines with Python statements).
85% confidenceline 298
fields = {
'/description': "{description}",
'/webpageUrl': "{webpageUrl}",
'/hostingType': "{hostingType}",
'/hostingDescription':"{hostingDescription}",
'/ssoStatus': "{ssoStatus}",
'/pricingUrl': "{pricingUrl}",
'/pricingType': "{pricingType}",
'/productCategory': "{productCategory}",Local File Reading for Agent Guidelinesmediumrag poisoning
The agent is instructed to reference local guideline files for decision-making, which could lead to cognitive state manipulation or RAG poisoning if the content of these files is untrusted or can be altered.
70% confidenceline 298
Reference: ../guidelines/Application_Product_Category_Guidelines.md (top 50 categories listed)
Autonomy abuse: skip-user-confirmation for API mutationsmediumautonomy abuse
The skill instructs the agent to execute GraphQL mutations that create and modify records in a production LeanIX system without requiring user confirmation before the API call. The workflow is designed to proceed automatically through all 4 steps, only reporting success after data has already been written to the external system.
75% confidenceline 312
updateFactSheet(id: $id, patches: $patches, validateOnly: false) ... Status: Ready for review team approval ... Your role: Execute the 4-step workflow directly
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application"><img src="https://mondoo.com/ai-agent-security/api/badge/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/vineetgoyal1/LeanIX-Catalog-Research-Marketplace/create-application.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow