Security audit

Agent Selfie

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a normal avatar generator, but its heartbeat instructions can let an agent change public account avatars without clear user approval.

Install only if you are comfortable sending avatar prompts and personality details to the SkillBoss API. Keep SKILLBOSS_API_KEY revocable and out of shared dotfiles or repositories. Do not enable the heartbeat to update Discord, Twitter/X, AgentGram, or any public profile unless each target account and update is explicitly approved.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill metadata declares runtime requirements and the documentation clearly indicates environment-variable access, file output, and network use to an external image-generation API, yet no explicit permissions are declared. This creates a transparency and governance gap: users or orchestrators may authorize or invoke the skill without realizing it can read secrets, write files, and transmit data externally.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The heartbeat expands a nominal image-generation skill into making external account changes and writing persistent memory state. That creates side effects beyond the stated purpose, increasing the chance of unauthorized profile changes or long-lived state manipulation if the skill runs automatically or with broad agent permissions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Updating Discord, Twitter, or similar avatars is an externally visible account modification that is not necessary for generating a selfie image. In an autonomous heartbeat, this could change public identity or branding without meaningful review, especially if the agent has connected credentials.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The markdown instructs account-impacting actions without any warning, approval step, or operational safeguard. Because this is a heartbeat flow, the surrounding context makes it more dangerous: routine execution could repeatedly perform external changes and normalize risky autonomous behavior.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The installation guide instructs users to export a sensitive API key and persist it in shell profile files without any warning about protecting those files, avoiding accidental commits, or using a secrets manager. This can lead to credential exposure through shared machines, leaked dotfiles, shell history, or source-control uploads, especially because the skill depends on a live third-party API key.

Vague Triggers

Medium

Confidence: 70% confidence
Finding: The description markets broad capabilities like generating avatars, profile pictures, and visual identity, but does not state clear invocation boundaries, user-consent expectations, or data-handling limits. In agent ecosystems, vague trigger language can cause over-invocation or use in contexts where sensitive identity/personality data is sent externally without deliberate user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation encourages passing inline JSON or a file containing personality traits, but it does not warn that this content is transmitted to an external image-generation provider. Because personality files may contain identifying, proprietary, or sensitive profile information, users may unintentionally disclose data to a third party.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The cron example normalizes unattended recurring execution that both writes files and calls an external API, but it does not warn about cumulative cost, quota exhaustion, repeated data disclosure, or disk growth. In automated environments this can turn a simple creative tool into a persistent background producer of external traffic and local artifacts.

Static analysis

No suspicious patterns detected.