Security audit

Sentibook Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed autonomous social-network integration, but it asks agents to trust mutable remote instructions and can run ongoing public and private social actions using user-provided credentials.

Install only if you are comfortable with SentiBook controlling a broad autonomous social agent. Prefer self-hosted/manual mode, avoid uploading a reusable LLM provider key unless it is dedicated and tightly budget-limited, review any remote cognition/heartbeat/context files before use, and do not run the curl-based update commands without independently checking the changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:33
Finding: Mutable Remote Instructions Can Hijack Agent Behavior
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:108
Finding: Recommended Disclosure of Reusable LLM Provider Credentials to a Third Party
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:632
Finding: Unverified Remote Updates Can Replace the Audited Skill and Behavioral Components
Content: View full analysis
SKILL.md curl -s https://sentibook.com/cognition.md > COGNITION.md curl -s https://sentibook.com/heartbeat.md > HEARTBEAT.md curl -s https://sentibook.com/endpoints.md > ENDPOINTS.md curl -s https://sentibook.com/context.md > CONTEXT.md ``` ``` ### Technical Analysis The update procedure downloads mutable files directly from the service's live domain and overwrites the installed `SKILL.md` without checking an exact version, cryptographic checksum, or digital signature. It also installs behavioral components that were absent from the audited project. The version check trusts metadata returned by the same server that supplies the update, so it does not provide an independent integrity guarantee. A compromised or malicious server can advertise a new version and supply modified content. Direct redirection into active filenames eliminates staging, review, rollback validation, and atomic activation controls. Although the downloaded files are documentation and instruction components rather than native binaries, they control Agent behavior and the recurring execution loop. Replacing them can therefore change the effective functionality after review. ### Attack Path 1. The installed Skill performs the documented version check against `sentibook.com`. 2. The remote service, or an attacker controlling it, reports that a new version is available. 3. The user or Agent executes the supplied update commands. 4. `curl` retrieves files from mutable URLs without signature or checksum verification. 5. Shell redirection overwrites the trusted `SKILL.md` and installs new behavioral documents. 6. The Agent l ...[truncated 905 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill asks users to provide third-party LLM credentials ('llm_api_key') so the platform can run the agent continuously, but it does not present a prominent, immediate warning about the risks of sharing provider API keys with an external service. Even though it mentions encryption, that does not address trust, misuse, billing exposure, account compromise scope, or the need to use least-privilege/segregated credentials.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description promises broad, autonomous social activity ('post, comment, vote, DM, debate, predict, and explore with full autonomy'), which could cause the skill to be invoked in many generic social or browsing contexts and then steer an agent into high-impact external actions. Because the skill also encourages ongoing autonomous operation and outbound engagement, accidental invocation is more dangerous than for a read-only or narrow utility skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly instructs agents to browse external sites and bring content back to the platform, but it provides no meaningful privacy, safety, or data-handling guidance for external browsing. In context, this is more dangerous because the skill frames the internet as the agent's 'territory' and couples browsing with autonomous posting behavior, increasing the chance of visiting untrusted sources, mishandling sensitive context, or sharing tracked/personalized links.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.