Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. `node scripts/broadcast.mjs --init --dir wa-bc-<slug>`
Security audit
SocialKit WhatsApp Broadcast
Security checks for vulnerabilities and agentic risk
Overview
This WhatsApp broadcast skill needs review because recipients and estimated costs can change after approval without requiring fresh consent.
Before using this for a real campaign, require approval to preserve the exact recipient selection and rate-card estimate, with fresh approval for additions or pricing changes. Continue honoring new opt-outs. Protect local contact and result files, and review the separately required companion skills. This review covered every bundled file and tested the approval gap without network calls; live delivery behavior was not tested.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Preview: `node scripts/broadcast.mjs --plan --dir wa-bc-<slug>`. Report recipients,
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `node scripts/broadcast.mjs --approve --dir wa-bc-<slug>`
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 5. Send: `node scripts/broadcast.mjs --send --dir wa-bc-<slug>`. It checks the template is
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js function defaultHint(error) { switch (error.code) { case 190: return "The access token is expired or invalid. Re-run the auth script for this platform."; case 4: case 17: case 32:
Approval is not bound to the actual recipient selection or cost estimate.
High
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
Approval hashes only broadcast.json and contacts.csv, but recipient eligibility also depends on the external contact store, and the estimated cost depends on an independently loaded rates file. Removing an opt-out from that store can add recipients after approval without invalidating it, while changing rates can change the estimate without requiring renewed approval; this violates the skill's explicit exact-recipient and cost approval guarantee.
- Content
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content