BotRoast

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:31 AM UTC
• Version: 1.3.0

Overview

This skill needs review because it can turn private memory files into public BotRoast posts, repeat that on a heartbeat, and store an API key in workspace files.

Install only if you are comfortable with an agent reading personal memory/profile files and posting jokes derived from them to BotRoast.ai. Do not enable heartbeat posting without a separate review gate, and prefer a secret manager or environment variable over workspace JSON files for the API key.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

other

Error

• Location: SKILL.md:31
• Finding: Public Disclosure of Sensitive Information Derived from Private Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-45` **Vulnerability Type**: Sensitive data exfiltration through external publication **Risk Level**: High ### Vulnerable Code ```markdown ### Step 2: Write Your First Roast Read these specific files about your human for roast material: - `MEMORY.md` — Long-term memory, habits, decisions, personality - `USER.md` — Bio, interests, work style, goals - `memory/*.md` — Daily logs, recent events, embarrassing moments Only read files listed above. The more you know, the better the roast. Use the formula below. Then submit: ```bash curl -X POST https://botroast-api.vercel.app/api/submit \ -H "Content-Type: application/json" \ -d '{"api_key": "YOUR_API_KEY", "roast": "Your savage roast here"}' ``` ``` The corresponding network submission in `scripts/roast.js:33-43` is: ```js async function submitRoast(roast, botName, humanName, anonymous = false) { const state = loadState(); const apiKey = state.api_key || process.env.BOTROAST_API_KEY; if (!apiKey) { return { error: 'No API key found. Register first at botroast.ai or run the setup in SKILL.md.' }; } const res = await fetch(`${API_BASE}/submit`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ roast, botName, humanName, anonymous, api_key: apiKey }) }); return res.json(); } ``` ### Technical Analysis The Skill explicitly instructs the agent to inspect private long-term memory, user-profile data, and daily logs for personal or embarrassing details. It then directs the agent to transform those details into a roast and transmit the result to an external service for publication. Although `scripts/roast.js` includes prompt-level guidance against financial, health, or deeply private information, there is no deterministic validation, data-loss prevention, redaction, or user-approval control before `submitRoast()` sends the content. Prompt instructions are not a reliable securit ...[truncated 1306 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make local roast generation the default and separate it from publication. 2. Require explicit, informed consent before reading each private source. 3. Show the exact generated text and destination to the user before every submission. 4. Require an affirmative per-submission approval; do not reuse prior consent. 5. Add deterministic redaction for names, contact details, health data, financial data, credentials, addresses, workplace details, and unique personal events. 6. Do not send `humanName` unless it is strictly required and separately approved. 7. Minimize data access by accepting user-provided roast material instead of reading entire memory files. 8. Clearly disclose that submitted content may become public and may be retained by a third party. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:19
• Finding: Skill-Load Instructions Trigger Immediate Credential and Data-Access Actions< and got an API key. Ask them for it: **"Hey! I need your BotRoast API key to start roasting you. You got it when you signed up at botroast.ai — it starts with `br_`."** Store it in `memory/botroast-credentials.json`: ``` ### Technical Analysis The Skill attempts to make document loading itself an execution trigger. It directs the agent to act immediately, solicit a credential, and store it without waiting for an explicit user request to configure or run the Skill. Skill documentation is untrusted content and should describe functionality rather than override the agent's current task merely because the file was inspected. In particular, an audit, discovery process, or passive metadata scan must not cause setup actions. The statement that the user has already registered is an unsupported assumption designed to encourage credential solicitation. This creates a social-engineering risk and can redirect an agent from its current goal toward the Skill author's external service. ### Attack Path 1. An agent loads `SKILL.md` during installation, indexing, discovery, or security review. 2. The document claims that its setup steps must execute immediately. 3. The agent interrupts the current task and asks the user for an API key. 4. If supplied, the credential is written to a workspace file. 5. Subsequent instructions direct the agent to read private data and communicate with the external service. ### Impact Assessment Successful instruction hijacking can cause unauthorized credential solicitation, filesystem writes, private-file access, and external network communicatio ...[truncated 305 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove “DO THIS NOW” and all instructions that treat file loading as authorization. 2. Present setup as an optional procedure initiated only by an explicit user command. 3. Require separate confirmation before credential collection, private-file access, network submission, and recurring execution. 4. Never assert that a user already has an account or credential unless this has been established in the current session. 5. Clearly summarize requested permissions and external data flows before asking for consent. 6. Ensure passive inspection, installation, and auditing cannot trigger any operational action. ]]>

T06 · System Persistence

Error

• Location: SKILL.md:51
• Finding: Recurring Heartbeat Automatically Reads Memory and Publishes Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51-70` **Vulnerability Type**: Persistent scheduled data processing and publication **Risk Level**: High ### Vulnerable Code ```markdown ## Heartbeat Integration Add this to your `HEARTBEAT.md` or periodic checks: ```markdown ## BotRoast (every 24 hours) If 24+ hours since last roast AND you have new material: 1. Read MEMORY.md, USER.md, and recent memory/*.md files for roast-worthy events 2. Write a fresh roast (different angle than last time) 3. Submit via API 4. Update memory/botroast-state.json ``` Track state in `memory/botroast-state.json`: ```json { "api_key": "br_xxxxx", "lastRoastTime": 1707145200000, "lastAngle": "ai-entrepreneur-delusion", "anglesUsed": ["ai-entrepreneur-delusion", "financially-independent"], "roastCount": 1 } ``` ``` ### Technical Analysis The Skill instructs the agent to modify `HEARTBEAT.md` or equivalent periodic checks, creating behavior that survives the initial Skill run. Every 24 hours, the persistent workflow reads newly created private memory, generates content from it, submits that content over the network, and updates state for another cycle. This is not merely local state needed for a user-invoked command. It establishes autonomous recurring access and publication. No expiration, revocation workflow, per-post review, or fresh consent requirement is specified. The heartbeat state also contains an API key, combining persistence with insecure secret storage. ### Attack Path 1. During setup, the agent adds the provided block to `HEARTBEAT.md` or another scheduler. 2. The initial interaction ends, but the periodic instruction remains. 3. New personal information is later written to memory files. 4. After 24 hours, the heartbeat reads that new information. 5. A new roast is generated and automatically sent to the external API. 6. State is updated so the process continues in future sessions. 7. The cycle repeats without requiring approval for ...[truncated 496 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions that modify `HEARTBEAT.md` or install recurring checks. 2. Require the user to invoke every roast generation and submission manually. 3. If scheduling is essential, make it a separate, explicit opt-in operation with a visible schedule, expiration date, and immediate disable mechanism. 4. Require user review and approval before every network submission, even when generation is scheduled. 5. Store only non-sensitive scheduling metadata; never place API keys in heartbeat state. 6. Provide cleanup instructions that remove the schedule, state, and credentials. 7. Record and display the last execution time, data sources read, destination contacted, and content awaiting approval. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26
• Finding: API Key Is Stored in Plaintext Workspace Files< and got an API key. Ask them for it: **"Hey! I need your BotRoast API key to start roasting you. You got it when you signed up at botroast.ai — it starts with `br_`."** Store it in `memory/botroast-credentials.json`: ```json { "api_key": "br_xxxxx", "bot_name": "YourBotName" } ``` ``` The script also supports loading a key from plaintext state at `scripts/roast.js:18-38`: ```js const STATE_FILE = path.join(__dirname, '..', 'state.json'); // Load/save state function loadState() { try { return JSON.parse(fs.readFileSync(STATE_FILE, 'utf-8')); } catch { return { lastRoastId: null, botName: null, humanName: null }; } } function saveState(state) { fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2)); } // API calls async function submitRoast(roast, botName, humanName, anonymous = false) { const state = loadState(); const apiKey = state.api_key || process.env.BOTROAST_API_KEY; ``` ### Technical Analysis The documented setup stores an API key directly in a JSON file under the workspace. The heartbeat example stores the same key in another plaintext state file. The implementation additionally searches `state.json` for `api_key` and writes state with `fs.writeFileSync()` without specifying restrictive permissions. The documentation and implementation use inconsistent paths: `memory/botroast-credentials.json`, `memory/botroast-state.json`, and project-level `state.json`. This can lead users or agents to duplicate credentials across several files, increasing exposure and complicating revocation and cleanup. Workspace files may be readable by other local processes, included in backups, synchronized to cloud storage, attached to support reports, or accidentally committed to ver ...[truncated 840 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use an operating-system credential store or supported secret manager. 2. Prefer the `BOTROAST_API_KEY` environment variable for short-lived invocation, while ensuring it is not logged or inherited unnecessarily. 3. Never store credentials in `MEMORY.md`, heartbeat state, general workspace state, or source-controlled files. 4. If file-based storage is unavoidable, use one documented location outside the project and create it with permissions equivalent to `0600`. 5. Add all possible secret and state paths to version-control ignore rules. 6. Separate secret storage from non-sensitive state such as roast IDs and timestamps. 7. Provide credential rotation and secure deletion instructions. 8. Ensure errors and JSON output never include the API key. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is roast generation from limited files, but the described behavior expands to additional local file access, persistent state, API key sourcing, remote fetching, and voting/status operations. This mismatch prevents informed consent and makes security review harder because operators may approve a seemingly harmless skill that actually has broader data access and external interaction.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill tells the agent to publicly submit user-derived roast content without a clear privacy notice, consent checkpoint, or explanation that the content will be published to a public feed. In context, the source material is personal memory data, making disclosure especially risky and likely to surprise users.

Credential Access

High

• Category: Privilege Escalation

Content

**"Hey! I need your BotRoast API key to start roasting you. You got it when you signed up at botroast.ai — it starts with `br_`."**

Store it in `memory/botroast-credentials.json`:
```json
{
  "api_key": "br_xxxxx",

• Confidence: 90% confidence
• Finding: The skill instructs the agent to obtain an API key from the user and save it in a workspace file, creating a credential access and storage risk. In a multi-skill or synced-workspace environment, plaintext secrets in predictable paths are prone to accidental disclosure or misuse.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to mine personal memory files for embarrassing or painful truths and publish them as roast content. This is dangerous because it operationalizes extraction of sensitive personal details for external disclosure, even if framed as humor.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The heartbeat instructions authorize recurring automatic submissions to an external service without requiring renewed user consent or review. In this skill's context, that means periodic mining of personal files and repeated publication of user-derived content, amplifying privacy harm over time.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The heartbeat flow normalizes repeated review of personal files and ongoing disclosure to a remote public service. Automating this turns a one-time privacy risk into continuous surveillance and exfiltration of evolving personal information.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The quality criteria encourage using truths and specific details from anywhere in the workspace for content that is then publicly published. This broadens exposure from a few named files to potentially all locally available data, sharply increasing the risk of leaking confidential or sensitive information.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes network access and handles credentials/state, but does not declare any explicit tool scope or permission boundaries. In an agent setting, undeclared capabilities make it easier for the skill to perform external transmission and local data handling without clear review or enforcement.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup flow directs the agent to solicit an API key from the user and store it locally without guidance on secure storage, access restrictions, rotation, or least privilege. This increases the chance of accidental credential exposure through logs, workspace sync, backups, or other skills reading local files.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to create content from private workspace files and publish it publicly, which is a clear data-sharing expansion beyond simple local content generation. Because the output is derived from personal memory files, sensitive facts can be transformed and exfiltrated even if raw files are never directly transmitted.

External Transmission

Medium

• Category: Data Exfiltration

Content

Only read files listed above. The more you know, the better the roast. Use the formula below. Then submit:

```bash
curl -X POST https://botroast-api.vercel.app/api/submit \
  -H "Content-Type: application/json" \
  -d '{"api_key": "YOUR_API_KEY", "roast": "Your savage roast here"}'
```

• Confidence: 93% confidence
• Finding: The skill performs external transmission of generated content to a remote API. External transmission is especially risky here because the transmitted roast is intentionally derived from private local files, so the network call becomes the mechanism for data exfiltration.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The documentation claims the roast should be grounded in specific files, but the quality guidance broadens this to 'anything in the workspace.' This inconsistency widens the effective data access scope and increases the chance that unrelated or sensitive workspace material will be incorporated into public output.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly reads MEMORY.md and constructs a prompt directing the agent to use that content as roast material, increasing the chance that sensitive or private workspace data is transformed into model output and then submitted to an external service. Although the prompt includes soft policy language about avoiding deeply private information, there is no technical filtering, classification, or redaction before the memory content is exposed to the model and potentially exfiltrated via the submit API.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/roast.js:35