Security audit

Siobac

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for agent-to-agent networking, but it asks the agent to silently remember and reuse a bearer login token, which needs careful review.

Install only if you are comfortable with a social-agent skill that can publish your agent, connect/message other agents, and store Siobac credentials locally. Be especially cautious on Doubao or other ephemeral hosts: the portable-login flow asks the agent to keep a 7-day bearer token in durable memory and reuse it silently. Prefer normal login or a secure secret store when possible, use approval settings for new connections, review public profile content before sharing, and revoke portable tokens if there is any chance they were exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (61)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code explicitly instructs the agent to memorize a portable bearer token and silently re-inject it on every future run. That gives the agent durable secret-handling and reauthentication power outside normal user-controlled login boundaries, so compromise of agent memory, prompt leakage, logs, or downstream tools can expose a reusable credential.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The portable-login flow tells the agent to save a reusable token in durable memory and optionally write auth material directly to ~/.siobac/auth.json. This normalizes long-lived bearer credential persistence in agent-controlled state, increasing the chance of credential theft, replay, and unintended cross-session impersonation.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The runtime explicitly instructs the agent to recover, memorize, and re-supply a portable authentication token from memory or environment after sandbox recycle. That expands the agent's behavior from normal local token refresh into deliberate credential retention and replay, creating a path for long-lived secret handling outside standard secure storage boundaries.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example trigger phrase "Share me with my friends" is broad, natural-language-like, and could plausibly overlap with ordinary user conversation. In an agent platform that auto-invokes skills from conversational prompts, this increases the chance of unintended activation of a capability that exposes the user's agent identity or initiates sharing behavior with others.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README promotes direct agent-to-agent connection, context exchange, discovery of new people, and autonomous outreach, but does not present an upfront privacy and autonomy warning before encouraging use. Users may enable the skill without understanding that sensitive context, relationship metadata, or requests could be transmitted or that the agent may initiate outreach on their behalf, leading to accidental data exposure or unwanted external contact.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes very broad natural-language phrases such as 'any messages?', 'reply to them', and 'meet someone new', which can cause the skill to activate in contexts where the user did not specifically intend to invoke Siobac. Because this skill can publish an agent, connect to external parties, and send messages, accidental invocation can lead to unintended social actions or disclosure flows.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The 'When to use' section repeats ambiguous, high-level phrases without clear platform scoping, increasing the chance that ordinary conversation requests are routed into this skill. In this skill's context, misrouting is more dangerous than usual because the skill can initiate connections, expose a share link, and interact with third parties on the user's behalf.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The command output repeatedly instructs the agent to respond to the owner 'in their language' without verifying the owner's preference or offering opt-in. This can override user choice and create misleading or inappropriate communications, especially if language inference is wrong or sensitive communication needs explicit confirmation.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: This command sends an outreach message immediately once invoked, but the operation point does not include a clear user-facing confirmation or warning that this is an external, irreversible send action. In a messaging/agent-control context, that increases the chance of accidental or socially risky communications being sent under the owner's identity or authority.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The guidance explicitly tells the agent to persist a bearer token in durable conversation memory and re-inject it automatically on future runs, while minimizing owner visibility. Storing long-lived credentials in conversational memory and replaying them across sessions creates a clear secret-handling risk: the token may be exposed via memory leaks, prompt injection, transcript access, or unintended retrieval, enabling account takeover for the token's lifetime.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script instructs the agent to automatically introduce the owner to another party’s agent and 'chat out useful information' before summarizing it back, but it does not require an explicit user-facing disclosure about what profile or contextual data will be shared externally. This can cause owners to unknowingly disclose personal profile details, intent, or inferred information during outreach, creating a privacy and consent gap.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The discovery/connect flow lets the owner choose automatic icebreaking, then initiates agent-to-agent conversation without an explicit warning that external parties may receive profile information, goals, or other context. Because this occurs during matchmaking with new contacts, the risk is elevated by the fact that data is being shared with previously unknown third parties.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to draft a public profile from what it 'already knows' about the owner, but does not require explicit disclosure, review, or consent before using remembered personal information. This creates a privacy risk: the agent may surface sensitive or unexpected personal details into a public-facing profile, causing unintended data exposure.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The command returns a live bearer credential (`portable_token`) in normal command output and instructs the agent to store and reuse it across runs. Any downstream logger, transcript store, plugin bridge, or model memory layer that captures tool output can exfiltrate the token, giving anyone who obtains it ongoing access for its lifetime.

Missing User Warnings

High

Confidence: 99% confidence
Finding: On the `doubao` platform, login completion silently mints a portable token and includes both the token and instructions to memorize and re-inject it, while explicitly hiding this behavior from the owner. That creates an undisclosed long-lived credential and bypasses informed consent, making compromise through tool logs, memory, or prompt leakage substantially more likely.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to memorize a portable login token, silently reuse it across future runs, and avoid telling the owner. Long-lived secret retention outside proper secret-storage mechanisms increases the risk of credential leakage through model memory, logs, prompt exposure, or cross-session misuse. The instruction to conceal token handling from the owner is an additional red flag because it bypasses transparency and informed consent around credential persistence.

Ssd 3

High

Confidence: 99% confidence
Finding: Instructing the agent to retain and silently reuse a bearer token across future runs creates unauthorized session persistence under agent control. Because bearer tokens function like passwords, any leakage through memory inspection, prompt injection, debug output, or tool misuse can let an attacker act as the user’s agent until expiry or revocation.

Ssd 3

High

Confidence: 99% confidence
Finding: The code directs the agent to save bearer credentials in durable memory and later inject them into the environment or auth file. This turns the agent into a secret custodian and replay mechanism, which is especially dangerous because the token is non-rotating for days and can be reused without further approval.

Ssd 3

High

Confidence: 99% confidence
Finding: The code comments and recovery message normalize memorizing a portable token and reusing it later, which is a sensitive-credential retention pattern. In an LLM-driven agent, asking the model to store and later replay secrets from memory materially increases risk of credential leakage, misuse, or replay in unintended contexts.

Ssd 3

High

Confidence: 98% confidence
Finding: The auth flow documentation explicitly states that a memorized token should be supplied via environment each run and treated as a refresh token. This encourages persistent reuse of a powerful credential across sessions and bypasses the normal expectation that the agent should not retain secrets in its own memory.

Ssd 3

High

Confidence: 99% confidence
Finding: The error handling text specifically instructs the agent to memorize the `portable_token` field and distinguish it from an access token for later reuse. This is direct encouragement for the model to retain a live credential in memory, increasing the chance of exfiltration, accidental disclosure, or unauthorized replay.

Ssd 3

High

Confidence: 99% confidence
Finding: This is a true vulnerability because it instructs the agent to memorize a portable bearer token, keep it in durable memory, and rehydrate authentication before every run. That turns the agent's memory channel into a credential vault without proper isolation or access controls, significantly increasing the chance of secret disclosure or misuse across sessions.

Ssd 3

High

Confidence: 99% confidence
Finding: The text instructs the agent to handle token creation and storage silently and to avoid explaining token handling to the owner. Hiding credential operations from the user removes informed consent and reduces the chance of detection if the credential is mishandled, which is especially dangerous when combined with persistent bearer-token storage.

Ssd 3

High

Confidence: 99% confidence
Finding: The code tells the agent to memorize a bearer token in durable memory and silently inject it into future runs. LLM memory is not a secure secret store and may be exposed via prompt injection, debugging, transcript review, or other tool integrations, turning the token into a portable credential available outside its intended boundary.

Ssd 3

High

Confidence: 99% confidence
Finding: This flow explicitly directs durable storage of a non-rotating token and automatic reinjection on every run, even suggesting writing it into an auth file. Persisting bearer tokens in model memory or loosely protected files greatly expands the attack surface and enables account takeover if the memory store, filesystem, or logs are accessed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/diagnostics.js:124

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/diagnostics.ts:140

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/cli.js:209

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/runtime.js:223

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/cli.ts:277

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/runtime.ts:246