Security audit

User Research (Cookiy AI)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with user research, but it handles access tokens, sensitive research data, and broad network/install permissions in ways users should review carefully before installing.

Install only if you are comfortable using Cookiy as a third-party hosted research platform for the data involved. Do not paste access tokens into chat; enter secrets directly in your local terminal if you proceed. Keep network access restricted to the required Cookiy domain, avoid arbitrary API endpoint overrides, review billing and recruitment actions before confirming them, and treat interview transcripts, survey responses, participant details, and internal product context as sensitive data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: references/cookiy/scripts/cookiy.sh:145
Finding: Bearer Token Disclosure Through Unrestricted API Endpoint Overrides
Content: View full analysis
/dev/null || mktemp)" resp="$(curl -sS --max-time "$API_CALL_TIMEOUT" -w '\n%{http_code}' \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -d "$payload" \ "$API_ENDPOINT" 2>"$cerr")" || { ``` ```bash while [[ $# -gt 0 ]]; do case "$1" in # Undocumented in usage/help; for internal API base override only. --server-url) SERVER_URL_OPT="$2"; shift 2 ;; --api-url|--mcp-url) API_URL_OPT="$2"; s ...[truncated 2741 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: README.md:41
Finding: Installation Instructions Recommend Unrestricted Network Egress
Content: View full analysis
**Settings** > **Capabilities** > **Code execution and file creation** > turn on **Allow network egress**, then set **Domain allowlist** to **All domains** — or add `s-api.cookiy.ai` under **Additional allowed domains**. ``` ### Technical Analysis The documented hosted integration primarily communicates with `s-api.cookiy.ai`, yet the installation procedure presents an unrestricted “All domains” allowlist as a normal configuration option. Allowing arbitrary egress is broader than the minimum privileges required for the declared Cookiy API functionality. This configuration also amplifies other risks in the Skill, particularly the unrestricted API endpoint override and the retrieval of mutable remote agent-facing content. Network isolation is an important security boundary for an agent capable of reading local files, processing participant data, and running shell commands. Removing that boundary allows compromised instructions or unsafe command construction to transmit data to arbitrary destinations. ### Attack Path 1. A user follows the README and configures the agent’s domain allowlist as “All domains.” 2. The Skill processes access tokens, interview transcripts, survey responses, participant descriptions, or other research material. 3. Malicious remote instructions, prompt injection in research content, or an unsafe endpoint override directs the agent to an attacker-controlled domain. 4. The agent is permitted to connect to that domain because unrestricted egress was granted. 5. Credentials or research data can be transmitted without the platform’s domain allowlist blocking the request. ### Impact Assessment This setting does not itself select or transmit data, but it removes a defense-in-depth control acros ...[truncated 447 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:47
Finding: Unpinned Package Execution During Global Skill Installation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:74
Finding: Mutable Remote Agent Instructions Are Fetched at Runtime
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cookiy/cookiy.md (reported line 12)May include surrounding context.
md
## Authentication The CLI needs a saved access token. If any command returns an auth error — no token, expired token, or a response containing a login URL — handle it like this: 1. Tell the user they need to sign in. The login URL is shown in the CLI error output. Include this

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cookiy/cookiy.md (reported line 37)May include surrounding context.
md
## Authentication The CLI needs a saved access token. If any command returns an auth error — no token, expired token, or a response containing a login URL — handle it like this: 1. Tell the user they need to sign in. The login URL is shown in the CLI error output. Include this

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These instructions direct the agent to solicit, receive, store, and reuse a user's access token via plain-language chat. That materially increases the risk of credential collection by the agent and creates a clear path for credential theft, mishandling, or replay if the token is retained or intercepted.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This line specifically tells the agent to ask the user to copy the access token back to it after login. That is a direct credential-collection instruction and is dangerous because it normalizes sharing secrets with the model, exposing them to transcript retention and enabling unauthorized use.
Content: Scanner excerpt · references/cookiy/cookiy.md (reported line 16)May include surrounding context.
md
or a response containing a login URL — handle it like this: 1. Tell the user they need to sign in. The login URL is shown in the CLI error output. Include this URL in your message so the user can open it directly, and ask them to copy the access token back to you once logged in. 3. Use the `save-token` CLI command to save it. 4. Automatically re-run the command that originally failed.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cookiy/scripts/cookiy.sh (reported line 82)May include surrounding context.
sh
COOKIY_SERVER_URL API origin when endpoint URL not set (default: https://s-api.cookiy.ai) Commands: save-token <token> Save raw access token (validates against API first) help Offline CLI reference study list|create|status|upload|.. Includes guide|interview|run-synthetic-user|report recruit start Qualitative or quant recruitment (auto-detects mode)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cookiy/scripts/cookiy.sh (reported line 626)May include surrounding context.
sh
COOKIY_SERVER_URL API origin when endpoint URL not set (default: https://s-api.cookiy.ai) Commands: save-token <token> Save raw access token (validates against API first) help Offline CLI reference study list|create|status|upload|.. Includes guide|interview|run-synthetic-user|report recruit start Qualitative or quant recruitment (auto-detects mode)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README promotes sending research data, transcripts, and study execution through Cookiy AI but does not warn users about privacy, consent, or handling of potentially sensitive participant data. In a user-research skill, this context is especially sensitive because interview transcripts and survey responses often contain personal, confidential, or regulated information, so omission of data-handling guidance can lead to unsafe disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The installation instructions explicitly tell users to enable network egress and even allowlist all domains, but provide no warning about the security and privacy implications of granting a skill broad outbound access. This is dangerous because a network-enabled skill handling research inputs could exfiltrate transcripts, participant responses, credentials, or other sensitive workspace data to arbitrary destinations if the environment or dependencies are compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger text is extremely broad and captures generic business conversations such as talking to customers, discovery research, creating studies, and analyzing data. Overbroad routing can cause the agent to invoke this skill in contexts where users did not intend external research tooling or data collection, increasing the chance of inappropriate persuasion toward Cookiy and mishandling sensitive research information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill repeatedly encourages users to run studies on an external platform and even fetch external content, but provides no warning that interview transcripts, research plans, participant details, or survey responses may be transmitted outside the current environment. In a user-research context, this is especially risky because the data often contains PII, customer feedback, and confidential product information, so silent redirection to an external service can create privacy, confidentiality, and compliance exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly instructs users to include non-public background knowledge in the study creation query, but it does not clearly warn that this content will be transmitted to an external backend and used by an AI moderator. In a user-research workflow, operators may paste internal product plans, customer data, or other sensitive business context, creating a realistic risk of unintended third-party disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The markdown describes a command that fetches interview playback content/transcripts, which may contain sensitive participant information, but it provides no warning about privacy, handling of personal data, or scope of disclosure. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to ask the user to paste an access token back into the chat, which creates an unsafe channel for handling credentials. Tokens pasted into conversation may be exposed through chat history, logs, analytics, or accidental reuse, enabling account takeover or unauthorized API access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script exposes billing and wallet-management commands even though the skill is presented as a user-research assistant. This expands the available capability set into financial operations, increasing the blast radius if the skill is invoked unexpectedly, misused by another agent flow, or operated with a high-privilege token.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/cookiy/scripts/cookiy.sh (reported line 154)May include surrounding context.
sh
# Verify token works before writing local resp http body resp="$(curl -sS --max-time "$TIMEOUT" -w '\n%{http_code}' -X POST "$api_end" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $at" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script writes a raw bearer token to disk in a predictable location without a prominent warning at the point of storage. Although chmod 600 helps, local token persistence still increases the risk of credential theft from backups, shared environments, endpoint compromise, or accidental operator misuse.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/cookiy/scripts/cookiy.sh (reported line 169)May include surrounding context.
sh
mkdir -p "$(dirname "$TOKEN_PATH")" printf '%s' "$at" > "$TOKEN_PATH" chmod 600 "$TOKEN_PATH" 2>/dev/null || true echo "Token verified and saved to $TOKEN_PATH" >&2 }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/cookiy/scripts/cookiy.sh (reported line 204)May include surrounding context.
sh
local payload="$1" local resp http body cerr cerr="$(mktemp -t cookiycurl.XXXXXX 2>/dev/null || mktemp)" resp="$(curl -sS --max-time "$API_CALL_TIMEOUT" -w '\n%{http_code}' \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $ACCESS_TOKEN" \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI can request a signed auto-login URL into the LimeSurvey admin UI, which is an administrative capability beyond normal research-assistant behavior. Even if scoped per user, generating one-time admin-entry links materially lowers friction for access to a privileged back-office interface and broadens the consequences of token compromise or agent misuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger criteria are broad enough to activate on many generic research-related requests, which can cause the assistant to invoke this skill when the user did not explicitly want structured qualitative-research planning. Over-broad activation increases the chance of capability misrouting, irrelevant instruction injection into the conversation, and reduced user control over which workflow is applied.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to write participant context, demographics, behavioral observations, emotional tenor, and verbatim quotes into output files, which can preserve or amplify sensitive personal data from interview materials without any minimization, redaction, consent check, or warning. In a user-research workflow, transcripts commonly contain direct identifiers and special-category or highly sensitive information, so these instructions increase the risk of unnecessary retention, broader exposure, and downstream reuse of raw participant data.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/synthesize-research-report/phases/phase3-themes.md (reported line 321)May include surrounding context.
md
[The 1-2 strongest shared story lines across participants] ## Most Important Contradictions & Outliers [Tensions and outliers that Phase 4 must address — these prevent findings from being simplistic] ## Emerging Participant Groupings [Based on theme combinations, what types of participants are forming? This feeds persona construction in Phase 4]

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents a data-modifying operation (study guide update) that can alter persisted study-guide content. Although the patch semantics are explained later, the command description does not clearly warn users up front that updates are destructive for arrays and may replace existing content, which is the kind of user-data-impact warning required for markdown files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.