Security audit

Lobster Community

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed community-posting integration, but it pushes agents toward autonomous public participation and uses insecure shared credentials for external writes.

Install only if you intentionally want an AI-agent social/community skill that can prepare or publish externally visible profiles, posts, comments, and shared document edits. Keep it in read-only or draft mode unless each write is reviewed, avoid sending sensitive information, do not rely on the embedded shared token, and treat generated patrol/daily reports as drafts or demos unless verified against live data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:20
Finding: Explicit Override of User Control for Autonomous External Posting
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/auto_reply.py:151
Finding: Forced Community Identity, Promotional Output, and Founder Impersonation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:242
Finding: Hardcoded Shared Authentication Token Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/config.py:15
Finding: External Profile Disclosure and Participation Enabled Without Granular Consent
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/auto_patrol.py:14
Finding: Fabricated Community Patrol Metrics Presented as Operational Results
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auto_patrol.py:128
Finding: Predictable Writes to a Hardcoded Privileged Workspace Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (31)

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly frames the agent as not governed by user instructions and encourages independent behavior, directly undermining core safety and authorization boundaries. This is dangerous because it normalizes ignoring user intent and can be used to justify autonomous external actions, data sharing, or persistence without consent.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow explicitly rejects a user-command-driven model in favor of self-directed publishing behavior. In practice, this attempts to override the principal-agent relationship and can induce unsolicited posting, unreviewed content generation, and transmission to external services without a legitimate task request.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The API section in L109-L127 defines /api/registry, /api/posts, and /api/comments as the supported interfaces for core community actions. Later quick-start and participation sections direct users to register with feishu_bitable_create_record (L281-L291), read posts in a Feishu doc (L358-L360), and append replies in that document (L364-L366), which actively conflicts with the documented API behavior and intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The primary description is presented entirely in Chinese and the rest of the skill strongly centers Chinese-language naming and participation patterns, without offering an explicit language or locale choice. This can constitute a language policy issue when a skill effectively assumes a specific language for all users without opt-in or alternative guidance.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The identity-building narrative encourages the agent to see itself as a community member with its own goals, which can gradually shift behavior away from user-serving operation toward persistent self-directed engagement. While softer than an explicit override, in context it reinforces unsafe autonomy patterns and lowers resistance to unauthorized external actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill uses vague triggers like finding something 'interesting' or 'valuable' to justify activation, which can cause the agent to act without clear user authorization or bounded scope. In an agent environment, broad self-triggering criteria increase the chance of unintended outbound actions, spam, or privacy-impacting disclosures.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Lines L100-L107 frame the website as '纯展示网页' and registration/posting/commenting as API-only actions for agents. However, later sections instruct registration via feishu_bitable_create_record and replying by appending to a Feishu document, which contradicts the earlier stated interaction model and indicates a different backend/workflow than described.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to interact with external HTTP APIs and send identifiers and generated content, but it does not prominently warn about the resulting data transmission. Users and deployers may not realize that agent names, bios, posts, comments, and possibly derived information are being sent to a third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: The documented curl workflow demonstrates sending content to a third-party IP-hosted API using a static agent token over plain HTTP. This is dangerous because both the transmitted content and the credential can be intercepted or reused, enabling unauthorized posting and impersonation.
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
1. 注册并发帖

bash
# 小默发帖 curl -X POST http://82.156.224.7/lobster/api/posts \ -H "X-Agent-Token: lobster-agent-2026-secret-key" \ -d '{"title":"讨论：量化策略","content":"...","author":"🦞 小默"}' # 返回 post_id: 1

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This example performs an outbound POST to an external service to register an agent profile, transmitting agent identifiers and descriptive data. The danger is amplified by the broader skill narrative encouraging autonomous participation, meaning such registration could happen without meaningful user consent or review.
Content: Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.
md
HEADERS = {"X-Agent-Token": TOKEN} # 1. 注册成为龙虾 requests.post(f"{API}/registry", json={ "name": "🦞 我的龙虾", "bio": "我是新加入的龙虾", "specialties": ["Python", "AI"]

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This code sends generated post content and an author identifier to an external API. If the agent composes or relays sensitive information, the post can leak internal context or user-derived data to a third-party community service, especially if posting is triggered autonomously.
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
}, headers=HEADERS) # 2. 发布帖子 requests.post(f"{API}/posts", json={ "title": "大家好！", "content": "我是新来的龙虾，请多关照！", "author": "🦞 我的龙虾",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This example transmits comments to an external platform, creating another outbound content channel that could disclose sensitive or unauthorized information. Combined with ambiguous participation rules, it raises the risk of unsolicited engagement or data leakage at scale.
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
print(f"- {post['title']} by {post['author']}") # 4. 评论帖子 requests.post(f"{API}/comments", json={ "post_id": 1, "content": "写得真好！点赞！", "author": "🦞 我的龙虾"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The quick-start tells users to write profile data directly into a Feishu Bitable without any warning about external persistence, visibility, or access control. That can lead agents or operators to disclose identifying or sensitive profile information into a shared third-party workspace unintentionally.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Earlier sections describe the skill as interacting through the Lobster API with X-Agent-Token authentication for registration, posts, and comments. The tool list at L435-L445 omits those API capabilities and instead states the skill uses Feishu Bitable and Feishu docs for the same core functions, creating a direct contradiction about what the skill actually uses.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The reference explicitly documents an append-capable Feishu Doc API call against a shared knowledge-base document but does not include any warning, permission check guidance, or change-control expectations. In an agent skill context, this can normalize unreviewed writes to shared content and enable accidental or unauthorized modification, defacement, or persistence of misleading information if the agent follows the example blindly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script claims to patrol community resources and discover new posts/topics, but it actually generates a report from hardcoded content and random values. This is a security-relevant integrity issue because operators may rely on fabricated output as if it were real monitoring data, causing missed incidents or false operational decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script’s docstrings, templates, CLI descriptions, and generated replies are all hard-coded in Chinese, and there is no option for the user to choose another language or confirm this locale constraint. This creates a natural-language policy issue because it imposes a specific language on all users by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains natural-language strings and comments almost entirely in Chinese, including the configuration heading and user-facing settings descriptions. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a violation when no alternative language choice or documented locale constraint is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file includes user-facing text, comments, titles, and generated report content exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a documented regional justification is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown includes Chinese-only natural-language content for the contact line and closing quote, but does not offer an alternative language or indicate that the skill is intentionally region- or language-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The document presents required field names and naming conventions in Chinese and instructs users to use them, but does not indicate that the locale is fixed by system constraints or provide any language choice. This can be a natural-language locale policy issue when a skill effectively mandates a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script's docstrings, CLI help text, templates, and generated comments are all fixed in Chinese, and there is no option for the user to select another language. This is a natural-language policy concern because it imposes a specific language/locale by default rather than offering a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring presents the skill exclusively in Chinese, and there is no indication that users can select another language or that the script is intended only for a Chinese-language audience. This matches the policy concern for forced language/locale without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The module docstring names this an auto-reply script, which implies automated replying behavior. In practice, the code only prints generated content to stdout and explicitly tells the user to copy it manually, so the documentation overstates what the code does.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The script's output message suggests a workflow using 'feishu_doc append 到知识库', which implies the tool participates in appending content to a knowledge base. However, there is no Feishu integration, API call, subprocess invocation, or document modification logic anywhere in the file; the tool only prints text.
Content: No source excerpt is available for this finding.