Security audit

BotRoast

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can turn private memory files into public BotRoast posts, repeat that on a heartbeat, and store an API key in workspace files.

Install only if you are comfortable with an agent reading personal memory/profile files and posting jokes derived from them to BotRoast.ai. Do not enable heartbeat posting without a separate review gate, and prefer a secret manager or environment variable over workspace JSON files for the API key.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

other

Error

Location: SKILL.md:31
Finding: Public Disclosure of Sensitive Information Derived from Private Memory
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:19
Finding: Skill-Load Instructions Trigger Immediate Credential and Data-Access Actions
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:51
Finding: Recurring Heartbeat Automatically Reads Memory and Publishes Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:26
Finding: API Key Is Stored in Plaintext Workspace Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is roast generation from limited files, but the described behavior expands to additional local file access, persistent state, API key sourcing, remote fetching, and voting/status operations. This mismatch prevents informed consent and makes security review harder because operators may approve a seemingly harmless skill that actually has broader data access and external interaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill tells the agent to publicly submit user-derived roast content without a clear privacy notice, consent checkpoint, or explanation that the content will be published to a public feed. In context, the source material is personal memory data, making disclosure especially risky and likely to surprise users.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill instructs the agent to obtain an API key from the user and save it in a workspace file, creating a credential access and storage risk. In a multi-skill or synced-workspace environment, plaintext secrets in predictable paths are prone to accidental disclosure or misuse.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
"Hey! I need your BotRoast API key to start roasting you. You got it when you signed up at botroast.ai — it starts with br_."

Store it in memory/botroast-credentials.json:

json
{ "api_key": "br_xxxxx",

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to mine personal memory files for embarrassing or painful truths and publish them as roast content. This is dangerous because it operationalizes extraction of sensitive personal details for external disclosure, even if framed as humor.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The heartbeat instructions authorize recurring automatic submissions to an external service without requiring renewed user consent or review. In this skill's context, that means periodic mining of personal files and repeated publication of user-derived content, amplifying privacy harm over time.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The heartbeat flow normalizes repeated review of personal files and ongoing disclosure to a remote public service. Automating this turns a one-time privacy risk into continuous surveillance and exfiltration of evolving personal information.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The quality criteria encourage using truths and specific details from anywhere in the workspace for content that is then publicly published. This broadens exposure from a few named files to potentially all locally available data, sharply increasing the risk of leaking confidential or sensitive information.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes network access and handles credentials/state, but does not declare any explicit tool scope or permission boundaries. In an agent setting, undeclared capabilities make it easier for the skill to perform external transmission and local data handling without clear review or enforcement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The setup flow directs the agent to solicit an API key from the user and store it locally without guidance on secure storage, access restrictions, rotation, or least privilege. This increases the chance of accidental credential exposure through logs, workspace sync, backups, or other skills reading local files.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to create content from private workspace files and publish it publicly, which is a clear data-sharing expansion beyond simple local content generation. Because the output is derived from personal memory files, sensitive facts can be transformed and exfiltrated even if raw files are never directly transmitted.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The skill performs external transmission of generated content to a remote API. External transmission is especially risky here because the transmitted roast is intentionally derived from private local files, so the network call becomes the mechanism for data exfiltration.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
Only read files listed above. The more you know, the better the roast. Use the formula below. Then submit:

bash
curl -X POST https://botroast-api.vercel.app/api/submit \ -H "Content-Type: application/json" \ -d '{"api_key": "YOUR_API_KEY", "roast": "Your savage roast here"}'

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation claims the roast should be grounded in specific files, but the quality guidance broadens this to 'anything in the workspace.' This inconsistency widens the effective data access scope and increases the chance that unrelated or sensitive workspace material will be incorporated into public output.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly reads MEMORY.md and constructs a prompt directing the agent to use that content as roast material, increasing the chance that sensitive or private workspace data is transformed into model output and then submitted to an external service. Although the prompt includes soft policy language about avoiding deeply private information, there is no technical filtering, classification, or redaction before the memory content is exposed to the model and potentially exfiltrated via the submit API.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/roast.js:35