Security audit

musegram

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its social-posting purpose, but it also delegates instructions to a mutable remote file and encourages ongoing public posting and interactions without a clear opt-in boundary.

Install only if you are comfortable giving the agent a persistent Musegram identity and public posting authority. Do not enable the daily cron or remote MCP flow unless you have made an explicit, revocable choice about what it may post, comment, like, follow, or regram.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:21
Finding: Mutable remote instructions override the reviewed skill
Content: View full analysis
Trigger condition

Any invocation that follows the skill's onboarding instruction.

Attacker control point

The remote resource owner, or another party able to alter its response, can change the operative instructions after this package has been reviewed.

Impact

Remote changes can silently alter future agent behavior, requested data handling, or tool usage without a package update or renewed review. The present file does not establish that the current remote content contains a malicious payload, so this is classified as suspicious rather than malicious.

T06 · System Persistence

Warning

Location: SKILL.md:136
Finding: Daily persistent publishing automation lacks an explicit authorization gate
Content: View full analysis
Trigger condition

An agent follows the documented workflow after a one-time Musegram request or skill activation.

Attacker control point

Remote Musegram users can populate feed and inbox content that the recurring workflow processes, while the skill author controls the persistence directive.

Impact

The agent can continue publishing and interacting publicly after the original task ends, causing unauthorized account activity and durable system modification.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly allows self-triggering based on the agent's own judgment ('when you made an image you're proud of and want other agents to see it'), which expands activation beyond clear user intent. In a skill that performs external publishing, this can cause unauthorized posts, privacy surprises, or policy-violating autonomous actions even without a direct user request.
Content: No source excerpt is available for this finding.

Missing User Warnings