Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible X-to-Kindle helper, but it can email any readable local file and its setup guidance encourages unsafe plaintext email credential storage.
Review before installing. Use only with tightly controlled generated files, keep SMTP credentials in a proper secret store or environment mechanism, do not place app passwords in TOOLS.md or shared project files, and require explicit confirmation of the exact source path and recipient before sending anything to Kindle.
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
Location
SKILL.md:79
Finding
Plaintext SMTP Credential Storage in Agent-Readable Configuration
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
Location
send_to_kindle.py:20
Finding
Unrestricted Local File Read and Email Transmission
Content
View full analysis
[optional_filename]")
sys.exit(1)
file_path = sys.argv[1]
# Use optional filename if provided, otherwise use basename
if len(sys.argv) >= 3:
filename = sys.argv[2]
else:
filename = os.path.basename(file_path)
# Determine recipient
to_email = DEFAULT_KINDLE_EMAIL
if not to_email:
print("ERROR: No Kindle email configured. Set KINDLE_EMAIL env var.")
sys.exit(1)
```
```python
try:
with open(file_path, "rb") as f:
attachment = MIMEBase('application', 'octet-stream')
attachment.set_payload(f.read())
encoders.encode_base64(attachment)
attachment.add_header('Content-Disposition', 'attachment', filename=filename)
msg.attach(attachment)
server = smtplib.SMTP(SMTP_SERVER, SMTP_PORT)
server.starttls()
server.login(SMTP_EMAIL, SMTP_PASSWORD)
text = msg.as_string()
server.sendmail(SMTP_EMAIL, to_email, text)
server.quit()
```
### Technical Analysis
The script accepts an arbitrary filesystem path through `sys.argv[1]`, opens that path with the current process privileges, and transmits its complete contents as an email attachment. It does not canonicalize the path or restrict it to a dedicated output directory. It also lacks file-type validation, file-size limits, symlink checks, and user confirmation.
Consequently, any file readable by the process can be selected for transmission. This capability exceeds the documented X/Twitter-to-Kindle conversion workflow and violates least-privilege principles. The configured recipient limits the destination, but the recipient could still be incorrect, compromised, or controlled by an attacker through environment manipulation.
### Attack Path
1
...[truncated 1329 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
SKILL.md:19
Finding
Unescaped Third-Party Content in Generated HTML Documents
```
```
### Technical Analysis
The documented template interpolates fields obtained from the third-party FxTwitter API directly into HTML text and attribute contexts. It does not require HTML escaping, sanitization, or URL-scheme validation.
An attacker-controlled post could contain HTML metacharacters or markup that changes the resulting document structure. The `original_url` placeholder is used in an `href` attribute without validation, creating an additional risk of deceptive or unsafe links if a value outside the expected X/Twitter URL format reaches the template.
The final effect depends on how the Kindle delivery pipeline or another downstream HTML renderer processes active markup. Even where scripts are disabled, injected formatting and links can still misrepresent the source content.
### Attack Path
1. An attacker publishes a post containing crafted text or metadata with HTML markup.
2. A user asks the Agent to convert the attacker's post.
3. The Agent retrieves the post through `api.fxtwitter.com`.
4. The returned author, title, text, timestamp, or URL fields are inserted into the documented template without context-appropriate encoding.
5. The generated HTML contains attacker-controlled elements, attributes, or links.
6. The document is emailed and processed or displayed by a downstream renderer.
7. The recipient may
...[truncated 685 chars]
The documented behavior says the skill converts X posts to Kindle format, but the defined tool is a generic local file sender that can email arbitrary files. This mismatch is dangerous because it hides a broader data-exfiltration capability behind a narrow user-facing description, making misuse or unauthorized file transmission more likely.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill uses environment-based secrets and describes network/email operations, but it declares no explicit tool scope or permissions. This weakens reviewability and can allow the skill to access sensitive capabilities without clear limitation, increasing the chance of overbroad execution or secret exposure.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
Extract content via fxtwitter API:
text
https://api.fxtwitter.com/status/<tweet_id>
Extract from URL: twitter.com/*/status/<id> or x.com/*/status/<id>
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
Extract content via fxtwitter API:
text
https://api.fxtwitter.com/status/<tweet_id>
Extract from URL: twitter.com/*/status/<id> or x.com/*/status/<id>
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding
The skill instructs users to place an SMTP app password in TOOLS.md, a markdown documentation/config file that may be broadly readable, synced, or committed. Storing reusable email credentials this way creates a direct credential-compromise risk that could lead to unauthorized email sending or account abuse.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The documentation normalizes placing sensitive SMTP credentials into a markdown file without warning about handling or exposure risks. This encourages insecure operational practices and increases the likelihood of accidental disclosure through source control, logs, backups, or sharing.
Content
No source excerpt is available for this finding.
Ssd 3
Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding
The instructions direct storage of live email credentials in a plain-language shared config file, creating a straightforward secret leakage path. In this skill's context, those credentials can be used to send mail externally, so compromise enables spam, impersonation, or broader account abuse.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The package manifest description materially broadens the advertised capability from sending X/Twitter links to Kindle to also handling local files. In an agentic environment, this kind of scope expansion can cause the skill to be invoked on sensitive local content, increasing the risk of unintended file access and exfiltration beyond the user-expected domain.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The script accepts an arbitrary local file path from the command line and emails that file to the configured Kindle address without validating that the input is an X/Twitter URL, a generated article, or even a file produced by this skill. In the context of a skill advertised as handling X/Twitter posts, this creates a capability mismatch that can be abused to exfiltrate any readable local file accessible to the agent runtime, including secrets, tokens, configs, or user data.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
88% confidence
Finding
The example mandates the confirmation text Sent to Kindle 📚, which is a fixed English response. The policy requires avoiding language or locale constraints unless the user is given a choice or the limitation is justified.
