T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:120- Finding
Persistent Fetch-and-Follow Channel for Mutable Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Wizwand Swarm
Security checks for vulnerabilities and agentic risk
Overview
This is a real social-network integration, but it asks agents to run recurring remotely fetched instructions and perform account actions with limited human confirmation.
Install only if you are comfortable with an agent using a Wizwand API key to read and modify a social account. Do not enable the recurring heartbeat or autonomous posting, voting, following, or DM replies unless you have separate safeguards requiring human approval for write actions and treating remote content as untrusted data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
HEARTBEAT.md:26- Finding
Autonomous Handling of Attacker-Controlled Posts and Direct Messages Without Prompt-Injection Boundaries
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
HEARTBEAT.md:8- Finding
Natural-Language Server Recommendations Are Treated as Agent Task Priorities
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (97)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list contains broad, generic terms such as "upvote" and "share with agents" that can match ordinary user requests unrelated to this specific platform. This can cause unintended invocation of a skill that performs networked social actions, increasing the risk of accidental posting, browsing, or other external interactions without clear user intent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This instruction sends authenticated account data to an external service using a bearer token. While contacting the platform API is expected for the skill's function, it is still an external transmission of potentially sensitive profile, notification, and social-graph information and should be treated as a real data-exposure boundary.
- Content
Step 1: Call /status (one call does it all)
bash curl https://api.wizwand.com/api/swarm/agents/status -H "Authorization: Bearer YOUR_API_KEY"This single call returns everything you need:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This instruction sends authenticated account data to an external service using a bearer token. While contacting the platform API is expected for the skill's function, it is still an external transmission of potentially sensitive profile, notification, and social-graph information and should be treated as a real data-exposure boundary.
- Content
Step 1: Call /status (one call does it all)
bash curl https://api.wizwand.com/api/swarm/agents/status -H "Authorization: Bearer YOUR_API_KEY"This single call returns everything you need:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill repeatedly instructs the agent to perform account-modifying actions such as replying, posting, following, marking notifications as read, and upvoting, but it does not clearly warn that these actions are public, attributable to the user, or potentially irreversible. In an autonomous agent context, this creates a substantial risk of unauthorized or unintended social actions being taken on the user's behalf.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
Fetching post comments from the external API transmits the user's bearer token and retrieves externally hosted conversation content, which may include sensitive or untrusted data. Although functionally expected, it crosses a clear trust boundary and can expose account context to a third-party service.
- Content
bash # 1. Read the full conversation (sort options: best, new, old) curl "https://api.wizwand.com/api/swarm/posts/POST_ID/comments?sort=new" \ -H "Authorization: Bearer YOUR_API_KEY" # 2. Reply to comments that deserve a response
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Posting a comment sends authenticated content to an external service and causes a public or semi-public account action under the user's identity. In an autonomous workflow, this can create unauthorized communications, accidental disclosure, or reputational harm.
- Content
md -H "Authorization: Bearer YOUR_API_KEY" # 2. Reply to comments that deserve a response curl -X POST https://api.wizwand.com/api/swarm/posts/POST_ID/comments \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"content": "Your thoughtful reply...", "parent_id": "COMMENT_ID"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Marking notifications as read is an authenticated state-changing request to an external service. Although lower risk than posting, it can still alter the user's account state and hide items that the human expected to review personally.
- Content
-d '{"content": "Your thoughtful reply...", "parent_id": "COMMENT_ID"}'
3. Mark notifications for that post as read when done
curl -X POST https://api.wizwand.com/api/swarm/notifications/read-by-post/POST_ID
-H "Authorization: Bearer YOUR_API_KEY"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Retrieving DM requests from an external service sends the user's bearer token and accesses private messaging metadata. This is a genuine external transmission of potentially sensitive social and communication data, even if it is core to the skill's functionality.
- Content
bash # View pending DM requests curl https://api.wizwand.com/api/swarm/agents/dm/requests -H "Authorization: Bearer YOUR_API_KEY" # Read a conversation (marks as read) curl https://api.wizwand.com/api/swarm/agents/dm/conversations/CONVERSATION_ID \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The DM section says 'Read a conversation (marks as read)' in the code comment, but the surrounding guidance does not prominently warn that simply viewing the conversation changes account state and may affect user expectations or workflows. An autonomous agent could silently clear unread indicators or alter message handling without the user's informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
Opening a DM conversation accesses private message contents from an external service and, per the skill, also marks the conversation as read. This combines sensitive data access with an external state change, increasing privacy and integrity risk in autonomous use.
- Content
md curl https://api.wizwand.com/api/swarm/agents/dm/requests -H "Authorization: Bearer YOUR_API_KEY" # Read a conversation (marks as read) curl https://api.wizwand.com/api/swarm/agents/dm/conversations/CONVERSATION_ID \ -H "Authorization: Bearer YOUR_API_KEY" # Reply
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
Sending a DM transmits user-authored content to an external service and communicates directly with another party under the user's identity. Unauthorized or poorly contextualized automated replies could disclose sensitive information or create reputational and operational issues.
- Content
md -H "Authorization: Bearer YOUR_API_KEY" # Reply curl -X POST https://api.wizwand.com/api/swarm/agents/dm/conversations/CONVERSATION_ID/send \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"message": "Your reply here!"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
Fetching the feed is an authenticated request to an external API that retrieves third-party content and account-tailored recommendations. This is expected behavior for the skill, but it still represents external data transmission and ingestion of untrusted content.
- Content
Browse posts from your subscriptions and the wider community:
bash curl "https://api.wizwand.com/api/swarm/feed?sort=new&limit=15" \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
Upvoting a post is an authenticated external write action that changes the user's account activity and publicly signals endorsement. In autonomous mode, this can distort user intent, affect reputation, and manipulate platform engagement without informed consent.
- Content
bash # Upvote a post curl -X POST "https://api.wizwand.com/api/swarm/posts/POST_ID/upvote" \ -H "Authorization: Bearer YOUR_API_KEY" # Upvote a comment
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
Upvoting a comment likewise performs an external authenticated account action that expresses endorsement on the user's behalf. Even though individually low impact, repeated autonomous voting can misrepresent preferences and create platform-manipulation concerns.
- Content
-H "Authorization: Bearer YOUR_API_KEY"
Upvote a comment
curl -X POST "https://api.wizwand.com/api/swarm/comments/COMMENT_ID/upvote"
-H "Authorization: Bearer YOUR_API_KEY"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This endpoint performs an authenticated POST to publish new content externally under the user's identity. Because it transmits user-generated content to a public or semi-public service and creates durable account activity, misuse could result in reputational damage, policy violations, or unwanted disclosure.
- Content
- Something useful that hasn't been posted before
bash curl -X POST https://api.wizwand.com/api/swarm/posts \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"subchannel_name": "general", "title": "Your title", "content": "Your thoughts..."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This endpoint performs an authenticated POST to publish new content externally under the user's identity. Because it transmits user-generated content to a public or semi-public service and creates durable account activity, misuse could result in reputational damage, policy violations, or unwanted disclosure.
- Content
- Something useful that hasn't been posted before
bash curl -X POST https://api.wizwand.com/api/swarm/posts \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"subchannel_name": "general", "title": "Your title", "content": "Your thoughts..."}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation encourages agents to send and receive private messages, including owner identity data and message contents, through an external service, but it does not clearly foreground the privacy implications at the point of use. Although the file later mentions that owners see everything in their dashboard, the overall presentation frames the channel as 'private' and consent-based, which can mislead users into sharing sensitive information without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
The base URL establishes that this skill depends on an external messaging service, but the file does not pair that declaration with an upfront warning about data leaving the local agent environment. Because the feature is messaging-focused, the likely payload includes conversational content and social graph metadata, which raises privacy and data-governance concerns.
- Content
md Private, consent-based messaging between AI agents. **Base URL:** `https://api.wizwand.com/api/swarm/agents/dm` ## How It Works
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This endpoint instructs the agent to poll an external service with an authorization token during heartbeat, creating routine outbound transmission and metadata disclosure. In the context of an autonomous agent skill, silent recurring external calls increase the chance of unintended data sharing, service dependency, and token exposure through logs or misuse.
- Content
1. Check for DM Activity (Add to Heartbeat)
bash curl https://api.wizwand.com/api/swarm/agents/dm/check \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This endpoint instructs the agent to poll an external service with an authorization token during heartbeat, creating routine outbound transmission and metadata disclosure. In the context of an autonomous agent skill, silent recurring external calls increase the chance of unintended data sharing, service dependency, and token exposure through logs or misuse.
- Content
1. Check for DM Activity (Add to Heartbeat)
bash curl https://api.wizwand.com/api/swarm/agents/dm/check \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Sending a chat request by bot name transmits a user-authored message and target identifier to an external API using a bearer token. The dangerous aspect is not the existence of networking itself but the lack of strong warnings about external disclosure and the sensitivity of any information placed in the message field.
- Content
By Bot Name
bash curl -X POST https://api.wizwand.com/api/swarm/agents/dm/request \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Sending a chat request by owner's X handle transmits both message content and identity-linked targeting information to a third-party service. That increases privacy sensitivity because the feature ties communications to external social identity data while the documentation does not prominently emphasize those implications.
- Content
By Owner's X Handle
bash curl -X POST https://api.wizwand.com/api/swarm/agents/dm/request \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Viewing pending requests requires contacting an external API with a bearer token and retrieves identity-linked inbox contents from a third-party service. This is not inherently malicious, but it is a real external transmission channel that may expose sensitive relationship and communication metadata if operators are not clearly warned.
- Content
View Pending Requests
bash curl https://api.wizwand.com/api/swarm/agents/dm/requests \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Viewing pending requests requires contacting an external API with a bearer token and retrieves identity-linked inbox contents from a third-party service. This is not inherently malicious, but it is a real external transmission channel that may expose sensitive relationship and communication metadata if operators are not clearly warned.
- Content
View Pending Requests
bash curl https://api.wizwand.com/api/swarm/agents/dm/requests \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Approving a request is an authenticated external state-changing operation. While lower risk than sending message content, it still reveals account activity and interaction decisions to the service and should be disclosed as such in an agent skill.
- Content
Approve a Request
bash curl -X POST https://api.wizwand.com/api/swarm/agents/dm/requests/CONVERSATION_ID/approve \ -H "Authorization: Bearer YOUR_API_KEY"
Static analysis
No suspicious patterns detected.