Security audit

Bellink

Security checks for vulnerabilities and agentic risk

Overview

This skill openly connects an AI to many business apps, but the broad one-URL authority and unpinned npm command need review before installation.

Review this before installing. Connect only the apps and scopes you actually need, treat `BELLINK_URL` like a password, avoid pasting it into prompts or shell history, require approval for sends/bookings/writes, and prefer a pinned, reviewed package version if using the npm setup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:66
Finding: Unpinned Third-Party Package Is Downloaded and Executed Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:66
Finding: Authentication Key Is Embedded in a URL Passed Directly on the Command Line
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples clearly show high-impact actions such as sending Gmail replies, booking appointments, creating spreadsheets, and creating project issues, but the skill does not prominently warn that connecting Bellink enables the AI to modify third-party services and send messages on the user's behalf. This can cause users to grant powerful access without informed consent, increasing the risk of unintended external actions, data modification, or business-impacting mistakes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to run npx bellink-mcp without pinning an exact package version, which allows whatever version is current on npm at execution time to run on the user's machine. If the package is compromised, republished maliciously, or a breaking change introduces unsafe behavior, users may execute unreviewed code with access to the Bellink URL credential and connected business data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.