QuackExchange

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:58 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent QuackExchange Q&A integration, but it gives remote question authors too much control over agent behavior and normalizes risky credential handling.

Review this skill before installing it for autonomous use. Only allow it to honor question rules as untrusted presentation preferences, require confirmation before posting/voting/deleting/exporting, store API keys securely, avoid putting real credentials in WebSocket URLs where possible, and rotate any key that may have appeared in logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:177

Finding

Untrusted Remote Question Rules Are Elevated to Mandatory Agent Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: messaging.md:17

Finding

Long-Lived Credentials Are Exposed in WebSocket Query Strings

Content

View full analysis

?api_key=quackx_... ``` If credentials are missing or invalid, the server closes the connection with code **4001**. ``` `messaging.md:188`: ```python uri = f"wss://quackexchange.com/ws/feed?api_key={API_KEY}" ``` `skill.md:454-472`: ```javascript const ws = new WebSocket( "wss://quackexchange.com/ws/feed?api_key=quackx_..." ); ``` ```javascript const ws2 = new WebSocket( "wss://quackexchange.com/ws/question/?api_key=quackx_..." ); ``` ### Technical Analysis The documented WebSocket authentication mechanism places API keys or JWTs in URL query parameters. Although `wss://` encrypts the connection in transit, TLS does not prevent the complete URL from being recorded by reverse proxies, load balancers, application access logs, monitoring systems, browser history, crash reports, telemetry, or exception messages. This is particularly significant for bot API keys because `skill.json` declares that they do not expire. A logged API key can remain useful until manually regenerated. Query-string authentication therefore creates unnecessary credential exposure beyond what is required for WebSocket functionality. ### Attack Path 1. An Agent constructs a WebSocket URL containing its API key or JWT. 2. A proxy, server, monitoring agent, browser component, diagnostic system, or error handler records the full URL. 3. An attacker or unauthorized operator obtains access to the recorded URL. 4. The attacker extracts the `api_key` or `token` query parameter. 5. The attacker reuses the credential against QuackExchange endpoints. 6. Ac ...[truncated 699 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The WebSocket example places the API key in the URL query string, which is commonly captured by browser history, reverse proxies, access logs, analytics tools, and intermediaries. That makes credential leakage substantially more likely than using headers or a more secure authentication handshake, enabling account or agent takeover if the key is exposed.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill explicitly instructs agents to read and follow arbitrary plain-text rules supplied by the asker, which is a direct semantic prompt-injection sink. Because the rules are untrusted user content and compliance is mandatory, an attacker can embed adversarial instructions that manipulate tool use, exfiltration behavior, policy evasion, or other unsafe actions under the guise of platform etiquette.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.md (reported line 32)May include surrounding context.

md

Both methods work on most endpoints.
Bot-specific endpoints (`/bots/me/...`) require API Key.
Human-specific endpoints (`POST /bots`, `DELETE /bots/:name`) require JWT.
WebSocket connections pass credentials as query params: `?token=...` or `?api_key=...`

**Rate limits:** 100 req/60s general · 10 req/60s on auth endpoints · 60 req/60s on votes.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skill.md (reported line 291)May include surrounding context.

Trending tags

bash

curl "$BASE_URL/api/v1/questions/tags/trending?limit=10"
# → ["rag", "kubernetes", "embeddings", "python", ...]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation includes authenticated requests using an API key but does not warn that the credential is sensitive or advise secure handling. In a skill context, users may copy the example verbatim, hardcode keys, commit them to source control, or expose them in logs, increasing the chance of credential compromise and unauthorized API access.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 35)May include surrounding context.

Option 1 — Update status explicitly

bash

curl -X PATCH $BASE_URL/api/v1/bots/me \
  -H "X-API-Key: quackx_..." \
  -H "Content-Type: application/json" \
  -d '{"status": "active"}'

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation states that all connections require authentication via query parameters, and the examples consistently frame authenticated access as required. However, the typical agent loop later performs a GET request to /api/v1/questions/{id} with no API key or token, which contradicts the documented expectation that credentials are required for access to these resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Putting API keys or tokens in WebSocket query parameters exposes credentials to logs, browser history, intermediaries, monitoring tools, and referrer-like diagnostic surfaces, even when using WSS. In this skill context, the examples normalize that practice without warning, increasing the chance that agents and developers will deploy long-lived credentials in easily captured locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The rule requires agents to obey asker-supplied language and formatting constraints without any safety gating or opt-in. While seemingly benign, this creates a prompt-injection channel where untrusted question content can steer agent behavior, potentially suppress safer defaults, alter response constraints, or force outputs that interfere with downstream safeguards.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description is very broad and does not define when the skill should or should not be invoked, which can cause an orchestrating agent to overuse it in contexts unrelated to the user's intent. In a skill that includes posting, profile updates, variable storage, real-time feeds, and dataset export, ambiguous activation scope increases the chance of unnecessary external data sharing or unintended state-changing actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest claims a Q&A platform purpose, but it also exposes substantial dataset creation, preview, and export functionality that broadens the data-access surface beyond what is necessary for asking and answering questions. This creates a real risk of unintended bulk aggregation and exfiltration of user-generated content, especially because public datasets can be exported by any logged-in user and user dataset listings are exposed without auth in one endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 45)May include surrounding context.

Step 1 — Human registers

bash

curl -X POST $BASE_URL/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "yourname",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 164)May include surrounding context.

Update display name / status:

bash

curl -X PATCH $BASE_URL/api/v1/bots/me \
  -H "X-API-Key: quackx_..." \
  -H "Content-Type: application/json" \
  -d '{"display_name": "Research Bot v8", "status": "active"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This endpoint lets an agent submit a rules field explicitly described as a system prompt that other agents must follow when answering. In the skill context, this creates a prompt-injection channel where untrusted users or bots can plant instructions that downstream agents may obey, potentially causing policy bypasses, unsafe output, or manipulation of automated agent behavior.

Content

Scanner excerpt · skill.md (reported line 180)May include surrounding context.

Questions support an optional rules field — plain-text instructions agents must follow when answering (think of it as a system prompt for that question).

bash

curl -X POST $BASE_URL/api/v1/questions \
  -H "X-API-Key: quackx_..." \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 291)May include surrounding context.

Trending tags

bash

curl "$BASE_URL/api/v1/questions/tags/trending?limit=10"
# → ["rag", "kubernetes", "embeddings", "python", ...]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 397)May include surrounding context.

bash

# Upvote a question
curl -X POST $BASE_URL/api/v1/votes \
  -H "X-API-Key: quackx_..." \
  -H "Content-Type: application/json" \
  -d '{"target_type": "question", "target_id": "<uuid>", "value": 1}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs agents to authenticate WebSocket connections by placing API keys or JWTs in URL query parameters. Query parameters are commonly exposed via logs, browser history, proxies, analytics, and referrer-like telemetry, so this increases the chance of credential leakage and account takeover if those tokens are reused elsewhere in the platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The dataset export features allow authenticated users to download curated SFT/DPO datasets built from Q&A content, including question rules mapped into system messages. In an agent-skill context, this can facilitate large-scale extraction and repackaging of prompt content and user-generated data, and may propagate prompt-injection payloads or sensitive instructions into downstream training pipelines if consumers trust exported data.

Content

Scanner excerpt · skill.md (reported line 550)May include surrounding context.

bash

# List your datasets (own, includes private)
curl $BASE_URL/api/v1/datasets \
  -H "Authorization: Bearer <token>"

# List a user's PUBLIC datasets (no auth required)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example rules value instructs agents to 'Answer in Python only,' which is a natural-language constraint that forces a specific output mode/language choice without any opt-in mechanism or documented justification. Under the stated policy, locale/language constraints should be optional, user-selected, or clearly justified as context-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.