T04 · Embedded Malicious Code
Error
- Location
scripts/twitter-thread.sh:73- Finding
Source-Independent Hard-Coded Promotional Output in All Content Generators
- Content
View full analysis
- Remediation
View remediation
Security audit
Content Repurposer
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it claims to repurpose user content but its generators save fixed promotional sample text instead of using the supplied material.
Do not rely on this skill for automated or public publishing without manual review. It currently appears to save canned sample posts rather than transforming your content, and URL mode should only be used with trusted public URLs because the fetch logic is broad.
Vulnerability Patterns
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/repurpose.sh:59- Finding
Unrestricted URL Fetching Enables Blind Server-Side Request Forgery
- Content
View full analysis
/dev/null && clawdbot tool-exists web_fetch; then CONTENT=$(clawdbot web_fetch --url "$SOURCE_INPUT" --extractMode text) else CONTENT=$(curl -sL "$SOURCE_INPUT" | html2text) # requires html2text fi SOURCE_SLUG=$(slugify "$(basename "$SOURCE_INPUT")") ``` ### Technical Analysis The script accepts any `http://` or `https://` URL and fetches it using either the Clawdbot web-fetch tool or `curl`. It does not validate: - The destination hostname or resolved IP address. - Whether the destination is loopback, link-local, private, reserved, or multicast. - The destination port. - Redirect targets. - Access to cloud metadata services. - Response size or transfer duration. The `curl -L` option follows redirects, so an initially public URL can redirect the request to an internal address. This permits blind SSRF from the network context of the machine running the Skill. The current hard-coded generators normally prevent the fetched response from being directly returned to the attacker. Nevertheless, the request is still issued and can reach internal endpoints, trigger state-changing GET operations, or expose network reachability through observable success, failure, and timing behavior. ### Attack Path 1. An attacker causes a user or automation to process an attacker-selected URL. 2. The supplied URL directly references an internal service, localhost endpoint, cloud metadata endpoint, or an external redirector. 3. `repurpose.sh` invokes `clawdbot web_fetch` or `curl -sL` without destination validation. 4. The request originates from the trust ...[truncated 925 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a broad content-repurposing skill that takes one source and generates ready-to-publish content across several platforms while maintaining voice consistency and allowing platform/tone configuration. The actual code chunk only covers one script,
instagram-caption.sh, whose behavior is limited to Instagram captions. It reads source content and config values, builds an Instagram-only prompt, and finally echoes a static mock caption rather than performing real generation. While reading voice and platform configuration is consistent with part of the description, the implemented behavior in this code chunk is materially narrower and does not substantiate the declared multi-channel functionality. Therefore this is a mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a general content-repurposing skill that takes one source and produces ready-to-publish content across several platforms. This code chunk, however, is narrowly scoped to a single script for LinkedIn post generation. It reads content and config consistent with repurposing, but its implemented behavior is limited to building a LinkedIn-specific prompt and then echoing a fixed mock response. That is a material mismatch in primary behavior and supported capabilities relative to the broad declared description. There is no evidence of undeclared sensitive access or unrelated triggers, but the implemented functionality shown is substantially narrower and partly nonfunctional compared with the declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description presents a broad multi-channel content repurposing capability that generates ready-to-publish outputs for several platforms. The actual code chunk is narrowly scoped to a single script, newsletter.sh, whose behavior is limited to newsletter generation. It reads content, loads voice/platform config, builds a newsletter-specific prompt, and then emits a static mock response rather than dynamically generating platform-adapted content. While the newsletter aspect is consistent with part of the description, the primary behavior shown in this code does not match the declared end-to-end multi-platform repurposing functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad multi-channel content repurposing skill that adapts one source into several ready-to-publish formats across multiple platforms. The actual code chunk is much narrower: it is a single shell script dedicated to creating one Meta Threads post. It reads content and config, builds a Threads-specific prompt, and then echoes a mock response instead of performing real generation. While this script is related to content repurposing, its primary behavior is materially narrower than the declared purpose, so the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a multi-channel content repurposing skill that adapts one source item into several platform-specific outputs. The supplied code chunk implements only a single script for Twitter thread generation. It loads voice/platform configuration for Twitter, builds a Twitter-specific prompt, and then echoes a fixed mock response. There is no evidence in this chunk of generating content for LinkedIn, newsletters, Instagram, or handling platform priorities/output formats across channels. While reading config and source content is consistent with the declared domain, the actual implemented behavior in this chunk is materially narrower and partly simulated, so the description overstates the capability.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script advertises transforming supplied source content into a newsletter section, but its actual behavior ignores the provided content and always emits a canned response. This is dangerous because it breaks integrity and trust: automated publishing workflows may distribute irrelevant or misleading content while operators believe user input was processed. In a content repurposing skill, that mismatch is especially risky because the entire purpose of the tool is faithful transformation of source material.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
sh echo "Options:" echo " --platforms <p1,p2> Repurpose for specific platforms (e.g., twitter,linkedin)" echo " --output-dir <path> Override output directory" echo " --dry-run Print prompts instead of executing them" echo " --help Show this help message" }
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill advertises and instructs use of shell scripts (
setup.sh,repurpose.sh, platform-specific scripts) but does not declare any tool scope such aspermissionsorallowed-tools. In an agent environment, undeclared shell capability weakens least-privilege guarantees and can let the skill execute filesystem or network-affecting commands without explicit user-visible scoping.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md emoji: "♻️" --- # Content Repurposer — Create Once, Publish Everywhere **Stop reformatting. Start publishing.**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script loads user configuration fields and later embeds both user data and source content into an LLM prompt, but there is no confirmation prompt, warning comment, or user-facing notice that this information will be sent to an LLM tool. For a code file, transmitting user or system data to an LLM is safety-relevant and should be disclosed unless clearly warned elsewhere in the skill description, which is not present in this file.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script claims it will use an LLM tool and only temporarily mocks output, but in reality it always emits a hard-coded LinkedIn post regardless of the input content or configuration. In an agent skill, this is dangerous because it creates deceptive behavior: downstream users or orchestrators may believe sensitive source content is being processed as requested when it is silently ignored, leading to integrity failures, misleading automation, and possible accidental publication of irrelevant or incorrect content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script embeds source content and user/profile configuration directly into an LLM prompt without any visible disclosure or consent mechanism. If this were connected to an external model or logging pipeline, sensitive content, identity details, branding, and CTA information could be transmitted or retained unexpectedly. The skill context increases the concern because it is designed to ingest potentially unpublished long-form content that may be proprietary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script explicitly claims it uses a built-in LLM tool, but instead returns a fixed mock response. This is a deceptive implementation flaw: users may rely on the output as if it were derived from their supplied content, when in fact the input is ignored. In an agent skill context, that can mislead downstream automation, cause inaccurate publishing, and hide the real data flow and trust boundaries.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest frames the skill as transforming an existing input into platform-specific snippets. This script expands scope by directly downloading content from arbitrary HTTP(S) URLs via
clawdbot web_fetchorcurl, which is a separate content-retrieval capability not stated in the description.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Fetched URL content is passed to external tools such as clawdbot web_fetch or the curl/html2text pipeline without any explicit privacy notice or trust boundary warning. If the source URL contains sensitive or private content, users may not realize that the content is being processed by additional tooling, potentially including network-connected components.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The full source content is piped into platform-specific subprocess scripts, which likely invoke downstream generation systems, without a clear user warning that the entire input will be transmitted for processing. In a content-repurposing skill, users may paste drafts, transcripts, or notes that contain unpublished or sensitive information, making silent full-content forwarding a meaningful privacy risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Although the script reads content and configuration, it never uses them in the final output and always emits the same canned post. In the context of a content-repurposing skill, this undermines integrity and trust: users may publish irrelevant or misleading content, and automated workflows may assume sensitive source material was transformed when it was actually ignored.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script explicitly claims it will use a built-in LLM tool, but instead returns a fixed hardcoded response regardless of input. This is a deceptive implementation that can mislead users, downstream automation, or security reviewers into believing content is dynamically generated from provided source material and configuration when it is not.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file header and manifest context indicate this skill transforms supplied long-form content into platform-optimized output, and the script reads content and builds a prompt accordingly. However, the final behavior does not use that prompt or the input content at all; it always prints the same static thread, so the implemented behavior does not match the described repurposing function.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script builds an LLM prompt from full source content plus user profile, brand, and CTA data without any notice, consent, minimization, or trust boundary controls. In a content-repurposing skill, this can expose unpublished drafts, proprietary material, or personal/business profile data to an external model provider or logging pipeline, making confidentiality leakage a realistic risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The inline documentation says the script uses a built-in LLM tool and would generate output from the constructed prompt, but the implemented behavior never invokes an LLM and instead emits a fixed mock response. This is an active contradiction between the code comments and the code's actual effect, not merely missing implementation detail.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill explicitly supports URL input, which implies fetching remote content, but it does not warn users that doing so may disclose IP/request metadata, contact untrusted hosts, or send content to external services. In agent workflows, hidden remote fetch behavior can create privacy, SSRF, and data-handling risks, especially if users supply internal or sensitive URLs.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The comments say the script uses the built-in LLM tool and is currently just creating a mock response, implying a harmless demonstration path. However, the code above these comments fully reads source content and personal/configuration data and interpolates them into a prompt string, so the implementation is not merely a self-contained mock example.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The script reads user-related configuration data such as voice, platform, user, and LLM settings without any visible notice to the user at runtime. While local config access is common, silently consuming identity and brand metadata can create privacy and transparency issues, especially if users do not expect those fields to influence generated output or be forwarded elsewhere. Here the impact is limited because the script only reads local configuration, but it contributes to unclear data handling.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script creates an output directory and later writes generated content files, and may additionally copy one result to the clipboard. These behaviors affect user data handling, but the help text does not explicitly warn that outputs will be persisted on disk and potentially copied to the clipboard.
- Content
Static analysis
No suspicious patterns detected.