Security audit

blockbeats

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed BlockBeats API helper that makes expected read-only crypto news and market-data requests, with minor routing and language-choice cautions.

Install only if you are comfortable sending crypto/news queries and your BlockBeats API key to BlockBeats. For ambiguous requests, explicitly name the skill or ask the agent before it makes external calls, and treat generated market signals as informational rather than investment advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Scenario 1 trigger phrases are broad, natural-language expressions such as 'How's the market today' and 'market overview', which can be matched during ordinary conversation and activate the skill unexpectedly. In an agent setting, over-broad activation can cause unprompted external API calls, context misrouting, and unintended disclosure of user interest or workflow state to a third-party service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Several request examples explicitly set lang=en, which imposes an English-language output choice. The document does not offer the user a language selection or explain that English is optional, which conflicts with the policy against forcing a language without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Phrases like 'smart money' and 'which tokens are being bought' are high-collision and may match many unrelated finance discussions. Because this scenario launches multiple parallel requests, accidental invocation increases data egress to the BlockBeats API and can steer the assistant away from the user's actual intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The macro-assessment trigger list includes generic phrases like 'big picture' and 'is it a good time to enter', which commonly appear in casual chat and advisory conversations. This makes unintended tool activation plausible, especially since the scenario aggregates several external data sources and presents synthesized guidance that may not have been requested.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The keyword-search trigger form is underspecified because patterns like '[keyword] news' or 'find [keyword]' overlap with ordinary assistant requests. That can cause the agent to convert general queries into third-party search requests, leaking query terms and introducing unexpected external-content retrieval.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The search example forces lang=en, indicating the skill will retrieve or present content in English regardless of user preference. No opt-in or locale-selection mechanism is described anywhere nearby.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The intent mapping covers many broad phrases such as 'what's new', 'latest news', and topic words like 'AI updates', creating wide activation boundaries. In an agent ecosystem this can hijack generic news requests, causing unnecessary remote calls and allowing this skill to dominate routing for common language patterns.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The request example sets lang=en for AI newsflash retrieval, which hard-codes a language choice. Because the skill does not provide a language option or explain a region-specific requirement, this is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reusable request template includes lang=en, suggesting English is the default enforced locale for general newsflash retrieval. There is no indication that users may choose another language or that the locale is inherited from the user's settings.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.