Security audit

last30days

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent recent-research skill that uses disclosed API credentials and user-directed local storage, with no evidence of hidden exfiltration or automatic persistence.

Install this only if you are comfortable sending research queries and retrieved snippets through AISA-hosted services and, when enabled, using your GitHub token for API reads. Review local config files for API keys, avoid enabling the optional Xiaohongshu/local API path unless you intend to use that logged-in service, and set watchlist webhooks only to endpoints you control.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (122)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This code chunk is a briefing generator for an existing 'last30days' dataset. It initializes a local store, lists topics, fetches stored findings, calculates top findings and weekly engagement changes, and saves or loads JSON briefing files under the user's home directory. There is no evidence in this chunk of querying Reddit, X/Twitter, YouTube, TikTok, Instagram, Hacker News, Polymarket, GitHub, or web search, nor of AISA planning, clustering, or reranking. Because the declared description emphasizes active recent cross-platform research, while the actual code’s primary behavior is summarizing previously collected local data into daily/weekly briefings, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says the skill performs recent cross-platform research and analysis. The actual code chunk does not implement any of that functionality; it only checks for an installed Python 3.12+ interpreter and prints its path. While this could be a supporting helper script for a larger system, the supplied code itself has a materially different immediate purpose than the declared skill behavior. Therefore this code chunk does not accurately represent the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for an end-user research/search skill that gathers recent results across multiple platforms. The supplied code chunk does not itself perform that user-facing research task; instead, it evaluates search quality between two versions of the tool. Its primary purpose is benchmarking: checking out revisions, running the search script, collecting ranked outputs, judging relevance, computing metrics, and generating reports. While it is related to the same broader domain (last-30-days search), this code chunk exposes materially different capabilities and behavior than the declared description, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a research skill that actively searches multiple online sources over the last 30 days and supports higher-level analysis features. The supplied code chunk does not do that. It only post-processes already-saved local JSON reports into compact markdown files. This is a materially different primary purpose from the declared behavior, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code chunk is narrower than the declared description. It defines endpoints and wrappers for AISA chat completions, Twitter advanced search, YouTube search, Tavily search, and Polymarket market search, along with response parsers and lightweight relevance scoring/date normalization. That partially matches the description's references to X/Twitter, YouTube, Polymarket, web search, and JSON output. However, there is no implementation for Reddit, TikTok, Instagram, Hacker News, or GitHub. The claimed support for planning, clustering, and reranking is also not present in this chunk beyond simple relevance heuristics. Because the declared purpose materially overstates the supported sources and higher-level capabilities, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk is a utility module for deduplicating text items, not a research engine. It defines text normalization, n-gram/token similarity, and a function to filter near-duplicate SourceItem entries. While deduplication could be a supporting component inside a broader research pipeline, the declared description presents the skill as actively researching recent content across many platforms and providing higher-level AISA features. None of those core behaviors are present in this code chunk, so the supplied implementation does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents the skill as a multi-source recent research tool covering Reddit, X/Twitter, YouTube, TikTok, Instagram, Hacker News, Polymarket, GitHub, and web search, with higher-level AISA features like planning, clustering, reranking, and JSON output. However, this specific code chunk does not implement research or analysis behavior. Its primary function is runtime configuration: loading secrets from environment files, selecting backends, and checking whether various integrations are available. While config management is a supporting detail for such a skill, this chunk also exposes additional undeclared integration surfaces—especially Xiaohongshu, Threads, and Pinterest—and actively probes Xiaohongshu over HTTP. That behavior is outside the declared source list. Therefore, the supplied code chunk does not accurately match the declared behavior for this skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description presents a multi-platform recent research tool covering many social and web sources, while this code chunk is exclusively a GitHub integration. A GitHub component is consistent with part of the description, so this is not wholly unrelated; however, the actual behavior includes substantial GitHub-specific capabilities beyond simple 'research the last 30 days,' including contributor/person profiling, own/external repo enrichment, README and release retrieval, top feature-request/complaint extraction, and candidate star annotation. It also requires authenticated access via environment tokens even though no permissions are declared. Because the code’s primary behavior in this chunk is narrower and more specialized than the declared broad cross-platform research purpose, and it uses undeclared authenticated resource access, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a comprehensive cross-platform recent-research skill, but the supplied code chunk only performs web search via AISA/Tavily and some basic date/url normalization helpers. There is no evidence here of connectors or retrieval logic for the listed social platforms, GitHub, Hacker News, or Polymarket, nor of planning, clustering, or reranking. This is a material description-to-behavior mismatch because the implemented primary capability in the chunk is much narrower than the declared skill scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This code does not appear malicious or unrelated, but it does materially differ from the declared description. The description explicitly lists supported sources for recent research and does not include Pinterest, while the code is entirely dedicated to Pinterest discovery. That is an undeclared resource/capability. Additionally, the chunk itself does not implement the broader multi-platform research behavior described; instead it performs one platform-specific search and normalization path. While a single module can be a supporting part of a larger system, the explicit omission of Pinterest from the declared sources creates a clear description-versus-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The core purpose largely matches: this pipeline researches recent content over the last N days (default 30) across Reddit, X, YouTube, TikTok, Instagram, Hacker News, Polymarket, GitHub, and web/grounding, then plans queries, normalizes, deduplicates, reranks, clusters, and returns a structured report. That is consistent with the declared description. However, the code materially exceeds the declared source coverage by also supporting Threads, Pinterest, and Xiaohongshu, none of which are mentioned. It also performs supplemental entity extraction from retrieved Reddit/X content to launch additional targeted X searches, and contains specialized GitHub person/project retrieval and post-rerank enrichment behavior that is more specific than the declared description. Because the evaluation criteria say to flag undeclared capabilities or inconsistent resource access, this should be marked as a mismatch despite the main purpose being mostly aligned.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a multi-source recent research skill across many social and web platforms. This code chunk, however, is narrowly focused on Polymarket only, using gamma-api.polymarket.com to search active prediction market events and parse/rerank them. It does not implement the other listed sources or general social research capabilities. Additionally, although search_polymarket accepts from_date and to_date, the code does not actually filter results by those dates, so the declared 'last 30 days' behavior is not represented here. While reranking/JSON-like normalized output are partially consistent, the primary described scope is much broader than the actual behavior shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a research capability that gathers recent data across many platforms. The supplied code chunk instead implements a post-research helper: it scores coverage across five sources, detects missing/errored integrations, and builds upgrade/configuration guidance text. While this may support the broader research system, the chunk’s actual behavior is materially different from the declared primary purpose and omits most of the stated platform/search functionality. Therefore this chunk is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a cross-platform social/web research skill covering many services and higher-level orchestration features. The supplied code chunk, however, is narrowly scoped to Reddit. It contains Reddit query handling, subreddit selection, public Reddit search delegation, comment retrieval, and comment enrichment. There is no evidence here of connectors for the other named platforms or of planning/clustering/reranking logic. This is a material scope mismatch in primary purpose, not just an implementation detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This code does not appear malicious or unrelated, but it materially underdelivers relative to the declared description. The description presents a multi-source last-30-days research capability spanning numerous platforms and higher-level planning/clustering/reranking features. The actual code exclusively queries Reddit public endpoints, handles retries/rate limits, parses posts, filters by date, sorts by engagement, and can optionally enrich with thread comments. That is a subset of the declared system, but for this supplied chunk the description is not accurate as a representation of what the code actually does. The mismatch is primarily one of scope and capabilities, not hidden undeclared behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad research skill that searches many external platforms and supports higher-level research features. The actual code chunk does not perform any searching, API access, recency filtering, planning, clustering, or JSON formatting. It is only a supporting relevance-ranking component. While reranking is loosely related, this chunk alone materially underimplements the declared primary purpose, so the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Most of the code is consistent with the declared reranking aspect of a research pipeline: it builds prompts for candidate relevance scoring, protects against prompt injection in scraped content, applies fallback heuristics, and sorts candidates by final score. However, the same module also defines a separate score_fun pathway that scores items for humor, wit, shareability, and virality, with prompts like 'You are the fun judge' and heuristics favoring short punchy content. That capability is materially different from the declared purpose of recent multi-platform research, company updates, competitor comparisons, and trend scans, and it is not mentioned in the description. Therefore this chunk contains an undeclared capability, creating a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description presents a comprehensive social/web research skill spanning many named platforms and advanced analysis features. This code chunk instead implements a helper that auto-resolves identifiers and context: it checks for an AISA backend key, runs four web searches (subreddit, news, X handle, GitHub), extracts entities from search results, and returns a small structured result. That behavior is related to research preparation, but it is materially narrower than the declared purpose and does not substantiate the advertised broad platform coverage or advanced planning/clustering/reranking capabilities. Therefore the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose centers on cross-platform last-30-days research and analysis. This code does not perform any research, querying, data collection, platform access, clustering, reranking, or JSON result assembly for those sources. Instead, its primary function is installation/setup support for an AISA-only runtime: it checks config flags, writes SETUP_COMPLETE into a .env file, probes local executables, and reports auth/setup availability. These are materially different capabilities and a different primary purpose from the declared research functionality, so this chunk is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description promises a broad multi-platform recent-research capability across several named sources (Reddit, X/Twitter, YouTube, TikTok, Instagram, Hacker News, Polymarket, GitHub, and web search). The code chunk, however, is specifically a Threads module: it searches site:threads.net, filters results to threads.net URLs, parses Threads-style fields, and returns normalized Threads items. That is a materially different and narrower actual behavior than the declared purpose. While using AISA aligns somewhat with the description’s mention of AISA-powered behavior, the core mismatch is that the code targets an undeclared platform (Threads) and does not implement the declared broad cross-platform research functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad cross-platform research capability over the last 30 days, but the supplied code only handles X/Twitter discovery and parsing. The primary purpose of this chunk is materially narrower than the declared purpose. It does not show support for the other listed platforms or higher-level AISA features like planning, clustering, or reranking. Additionally, the function signature accepts both from_date and to_date, but the implementation explicitly discards to_date, which further suggests the behavior does not fully match the stated date-range research framing. This is a description-behavior mismatch for the provided code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This code chunk’s primary behavior is a Xiaohongshu-specific HTTP search integration, not a generic cross-platform last-30-days research capability. The description lists many sources, but Xiaohongshu is not among them, making the accessed resource inconsistent with the declaration. The code also requires a logged-in Xiaohongshu API session and applies platform-specific publish_time filters, which are materially different from the declared broad recent-social-research framing. While this could be one component of a larger system, evaluated on its own it does not accurately match the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This code’s primary purpose is specifically X/Twitter search compatibility. It defines depth configs, normalizes tweet fields/dates, calls either AISA Twitter search or a legacy Xquik endpoint, and returns tweet items. There is no evidence in this chunk of searching Reddit, YouTube, TikTok, Instagram, Hacker News, Polymarket, GitHub, or general web search, nor of orchestration/planning/clustering/reranking. While the declared description may refer to a larger skill, this supplied code chunk materially underimplements that stated scope and represents a narrower resource access pattern centered only on X/Twitter.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises a research skill that gathers and analyzes recent information from many external platforms. The supplied code chunk does not implement or expose any such behavior; it only dispatches to a Python evaluation script named evaluate_search_quality.py. Based on this chunk, the primary observed purpose is running an internal evaluation utility, not performing the described social/web research workflow. This is a material description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill performs recent multi-source social/web research and analysis. The supplied code chunk is only a test runner shell script that invokes pytest. Its primary purpose is software testing, not research, and it does not implement or access any of the described platforms or analysis features. This is a clear material mismatch between declared purpose and actual behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.