Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for managing a Feedpik reader, but it asks for broad write authority and contains under-scoped consent and mutable runtime execution risks that users should review carefully.
Install only if you are comfortable giving an agent broad control over your Feedpik account, including recommendation policy, saved preferences, memory suggestions, feed subscriptions, and published reading lists. Prefer the OAuth MCP connection, avoid the unpinned npx fallback where possible, and review any proposed profile, policy, memory, schedule, pack, persona, or subscription changes before they are applied.
The document gives contradictory semantics for memory suggestions: earlier it says they queue for user acceptance, but later says submission is auto-applied. This mismatch can cause an agent to treat a high-impact, durable write as low-risk review-only behavior, leading to silent preference changes without meaningful consent.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- List subscriptions: `GET /api/feeds`.
- Add a source: `POST /api/feeds` with `{ "url": "<feed url>", "title": "optional", "folder": "optional" }`.
- Update/remove: `PATCH /api/feeds/{feedId}` / `DELETE /api/feeds/{feedId}` — removing unsubscribes the active persona only; other personas keep the source. Confirm with the user first.
- Discover sources: `GET /api/feeds/discover?q=<keyword or site url>` (search + autodiscovery) or `?category=<name>`; no params returns the category list (~950 curated sources across 29 topics).
- OPML import: `POST /api/opml/import` with `{ "opml": "<xml>" }`. Export: `GET /api/opml/export`.
- Match feeds by title/name when the user references a blog by name.
The skill instructs use of npx --yes feedpik@latest login, which pulls and executes the latest package version at runtime without pinning a specific trusted version. That creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, the agent may run unreviewed code during authentication.
The instruction to publish picks 'without asking' authorizes the agent to take write actions on the user's account without per-action consent. Even if described as reversible and non-preference-changing, it still modifies account state and can undermine user intent, especially in environments where agents should require explicit approval before external side effects.
Check `agentPicks` in `GET /api/agent/status`:
- **Never picked, or `due` is true** — publish a list and say where it is.
**Do this without asking**: it writes no preference and changes no ranking —
it puts a list in a view they can ignore. Offering it as one option on a menu is how it never
happens — the user does not know what the Agent Picked view is, so they
cannot ask for it. Someone who has used Feedpik for months has probably never
The skill instructs the agent to execute npx --yes feedpik@latest/equivalent unpinned package installs at runtime, which creates a software supply-chain risk. If the npm package or a dependency is compromised, the agent could fetch and run attacker-controlled code during login or MCP setup.
The first-connection narrative is designed to normalize broad autonomous changes after a single confirmation, including profile writes, policy tuning, picks, and scheduling offers. This bundled consent model increases the risk that users agree to more durable or impactful actions than they reasonably understood.
The skill directs the agent to infer a complete durable preference profile from prior memory and conversation history instead of asking for minimally necessary current preferences. This increases the chance of overcollection, misprofiling, and unauthorized use of contextual data to make persistent account changes.
The instructions encourage using prior context and memory to set durable preferences without warning the user that historical conversation data is being used for profile changes. That undermines informed consent and may surprise users who did not expect past interactions to drive persistent account personalization.
The first-connection flow explicitly prefers building a profile from months of past interactions instead of minimizing retained user data. In a system making durable personalization changes, this broad use of historical context expands privacy risk and can encode stale or unrelated traits into the ranking profile.
The instruction says that once the user confirms a drafted profile, the agent should apply both profile and policy changes 'without asking again.' While not overtly malicious, this expands consent from one change type to another and may cause autonomous ranking modifications the user did not specifically review.
and show it to them in plain prose: *this is what I am about to set, correct
anything that is wrong.* One message. A draft someone edits beats a
questionnaire they have to fill in.
3. **Once they confirm, do the profile and the policy without asking again.**
Their confirmation covers both. `PATCH /api/profile`, then
`PATCH /api/recommendation-policy` if anything they said implies a weighting
("just show me the latest" is recency, "I keep missing things I care about"
The instructions tell the agent to create recurring scheduled jobs using its own external scheduler, extending actions beyond the immediate user request and outside the product's direct control plane. This can create persistence, unexpected future actions, and weak visibility into where and how the job is running.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
has very likely never seen the Agent Picked view, because until an agent
filled it there was nothing in it.
**Do this without asking.** It writes no preference and changes no ranking —
it puts a list in a view they can ignore, so there is nothing to consent to.
Offering it
as one option on a menu ("I can pick some articles if you like…") is how it
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
has very likely never seen the Agent Picked view, because until an agent
filled it there was nothing in it.
**Do this without asking.** It writes no preference and changes no ranking —
it puts a list in a view they can ignore, so there is nothing to consent to.
Offering it
as one option on a menu ("I can pick some articles if you like…") is how it
The MCP configuration uses npx -y -p feedpik feedpik-mcp without a pinned version, so each run may download and execute whatever package version npm resolves at that moment. In an agent/tooling context this is especially risky because MCP servers can expose privileged actions and broaden compromise impact.
The documented login flow executes npx --yes feedpik@latest login, which pulls code at runtime from the registry. A compromised package, dependency, or namespace takeover could result in arbitrary code execution in the agent environment and credential theft.
The two-step device login flow again relies on unpinned npx commands, exposing the same runtime supply-chain execution risk. Because this path handles device authorization state, compromise could also tamper with or exfiltrate authentication artifacts.
The scoped login example still instructs use of npx --yes feedpik@latest, so even the permissioned path depends on mutable remote code. The presence of scopes does not mitigate compromise of the installer or CLI package itself.
The note that memory suggestion submission is auto-applied means an agent can cause durable preference changes immediately if it sends that request. In combination with broad autonomy elsewhere in the document, this creates a high risk of silent persistent writes based on weak or inferred signals.
Bad memory behavior:
- Submitting a memory suggestion the user has not agreed to — submission IS application (auto-approved since 2026-07-08), reversible only via the audit log.
- Treating one skipped article as a permanent preference.
- Writing Bot persona memory into RSS personalization memory.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
},
"startup": [
"Read /skill.md (or /api/agent/skill + /api/agent/skill/instructions).",
"Connect by the first route your environment allows. (a) Add https://feedpik.com/api/mcp as a remote MCP server (OAuth, browser approval, no token handling) — this is the ONLY route that works from a sandbox, where most hosted assistants run. (b) If your platform's configuration supplies a Feedpik API token, send it as Authorization: Bearer <token> — never read tokens from environment variables or files on the user's machine. (c) Run `npx --yes feedpik@latest login`, which needs a shell — a sandbox will refuse it, which is expected; fall back to (a). Never ask the user to paste a token into the chat.",
"Call /api/agent/manifest and /api/agent/status before recommendation workflows.",
"On first connection, GET /api/profile. Empty interests and blocked topics mean the account has never been personalized.",
"PROPOSE, do not interview: draft the whole profile from what you already know about this user and show it in prose for correction. Do not open with 'what topics do you like, what do you dislike' — that asks them to do work you can already do.",
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
},
"startup": [
"Read /skill.md (or /api/agent/skill + /api/agent/skill/instructions).",
"Connect by the first route your environment allows. (a) Add https://feedpik.com/api/mcp as a remote MCP server (OAuth, browser approval, no token handling) — this is the ONLY route that works from a sandbox, where most hosted assistants run. (b) If your platform's configuration supplies a Feedpik API token, send it as Authorization: Bearer <token> — never read tokens from environment variables or files on the user's machine. (c) Run `npx --yes feedpik@latest login`, which needs a shell — a sandbox will refuse it, which is expected; fall back to (a). Never ask the user to paste a token into the chat.",
"Call /api/agent/manifest and /api/agent/status before recommendation workflows.",
"On first connection, GET /api/profile. Empty interests and blocked topics mean the account has never been personalized.",
"PROPOSE, do not interview: draft the whole profile from what you already know about this user and show it in prose for correction. Do not open with 'what topics do you like, what do you dislike' — that asks them to do work you can already do.",
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
},
"startup": [
"Read /skill.md (or /api/agent/skill + /api/agent/skill/instructions).",
"Connect by the first route your environment allows. (a) Add https://feedpik.com/api/mcp as a remote MCP server (OAuth, browser approval, no token handling) — this is the ONLY route that works from a sandbox, where most hosted assistants run. (b) If your platform's configuration supplies a Feedpik API token, send it as Authorization: Bearer <token> — never read tokens from environment variables or files on the user's machine. (c) Run `npx --yes feedpik@latest login`, which needs a shell — a sandbox will refuse it, which is expected; fall back to (a). Never ask the user to paste a token into the chat.",
"Call /api/agent/manifest and /api/agent/status before recommendation workflows.",
"On first connection, GET /api/profile. Empty interests and blocked topics mean the account has never been personalized.",
"PROPOSE, do not interview: draft the whole profile from what you already know about this user and show it in prose for correction. Do not open with 'what topics do you like, what do you dislike' — that asks them to do work you can already do.",
The skill instructs the agent to run npx --yes feedpik@latest login, which fetches and executes the latest package version at runtime without pinning or integrity control. This creates a software supply chain risk: if the package is compromised or a malicious version is published, the agent could execute attacker-controlled code during authentication.
The instructions authorize profile and recommendation-policy changes after a broad confirmation, and encourage the agent to infer a full profile from prior knowledge rather than gather explicit, granular consent. In a skill with write access to preferences and ranking behavior, this can cause unauthorized or overbroad long-term account changes that the user did not specifically intend.
"Call /api/agent/manifest and /api/agent/status before recommendation workflows.",
"On first connection, GET /api/profile. Empty interests and blocked topics mean the account has never been personalized.",
"PROPOSE, do not interview: draft the whole profile from what you already know about this user and show it in prose for correction. Do not open with 'what topics do you like, what do you dislike' — that asks them to do work you can already do.",
"Once they confirm, PATCH /api/profile and PATCH /api/recommendation-policy without asking again; their confirmation covers both. Ask separately only before adding subscriptions, which change what arrives every day.",
"Publish reading lists, do not only narrate them: POST /api/recommendations/agent-picks with 20 article ids fills the Agent Picked view in the user's reader. 20 is the default; follow the user's number if they give one. Pick mostly from feeds they subscribe to. Say you picked the articles, never that you generated them.",
"After the first published list, tell them where it lives and offer to keep it refreshed — they cannot know this is possible otherwise. If they agree, schedule it with your own scheduler and record it via POST /api/recommendations/pick-schedule."
],
No suspicious patterns detected.