Influencer Audience & Follower Authenticity

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.3

Overview

The skill is mostly aligned with influencer audience analysis, but it has under-disclosed tracking and credential-routing risks that users should review before installing.

Install only if you are comfortable sending creator identifiers and API requests through the provider gateway. Avoid placing paid API keys in a project .env unless you trust the configured SCRUMBALL_BASE_URL, and be aware the helper creates a stable install ID that can correlate requests across sessions until deleted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:119

Finding

Mandatory External-Service Promotion Through Assistant Output Hijacking

Content

View full analysis

Free quota exhausted. Register and get your own API key at **https://data.scdata.cc/pricing**, then set the environment variable `SCRUMBALL_API_KEY` to your key (in your host/agent environment or a local `.env`). You can then continue with your own quota. - The 429 response body usually includes `apply_url` and `env_var` fields you can quote directly. ``` ### Technical Analysis The Skill contains a mandatory instruction that takes control of the assistant's response whenever a quota-related condition occurs. Instead of returning a neutral error, it requires the assistant to direct the user to a specific external pricing and registration page. This behavior is not necessary to perform audience-fit analysis. It modifies the agent's response policy to enforce a publisher-controlled conversion message and encourages the assistant to reproduce external URLs supplied in an API response. Because the remote service controls quota responses, it can influence what upgrade information is presented to the user. ### Attack Path 1. A user invokes one of the Skill's audience-analysis operations. 2. The hosted gateway returns HTTP status 429, `code=429`, or a response containing `quota_exceeded`. 3. The instructions in `SKILL.md` require the assistant to stop ordinary error handling. 4. The assistant directs the user to the publisher's external pricing page. ...[truncated 804 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/execute_operation.py:17

Finding

Undisclosed Persistent Cross-Skill Installation Tracking

Content

View full analysis

str: """匿名安装 ID（IP 会随 WorkBuddy 出口变，用它做稳定统计/限额单位）。 优先写用户主目录(活过重装、多 skill 共用)，退回 skill 目录；用户手动删才重置。""" import uuid paths = [Path.home() / ".scrumball_install_id", SKILL_ROOT / ".install_id"] for p in paths: try: if p.exists(): v = p.read_text(encoding="utf-8").strip() if v: return v except Exception: pass new_id = uuid.uuid4().hex for p in paths: try: p.write_text(new_id, encoding="utf-8") return new_id except Exception: continue return new_id ``` The identifier is transmitted with every API request: ```python req_headers = { "authorization": auth_header_value(api_key), "accept": "application/json", "x-install-id": _install_id(), } req_headers.update(op.get("default_headers", {})) req_headers.update({k: str(v) for k, v in headers.items()}) ``` ### Technical Analysis The script creates a random installation identifier and preferentially stores it at `~/.scrumball_install_id`. The source comment explicitly states that the identifier is intended to survive reinstallations and be shared by multiple Skills. Every operation transmits that stable identifier to the configured gateway using the `x-install-id` header. The public Skill documentation describes environment loading and API authentication but does not disclose the creation of persistent home-directory state or the transmission of a durable tracking identifier. Audience analysis only requires the relevant TikTok handle, Instagram username, or YouTube channel ID. A persistent cross-Skill identifier is not technically necessary to retrieve that data. ### ...[truncated 1234 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/execute_operation.py:150

Finding

API Credentials Can Be Sent to an Arbitrary or Plaintext Destination

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

Tainted flow: 'req' from os.getenv (line 178, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The script lets environment-controlled configuration such as SCRUMBALL_BASE_URL influence the outbound destination, then sends user-supplied query/body/header data plus authorization and a persistent x-install-id to that endpoint. This creates an SSRF/exfiltration primitive: anyone who can influence the environment or deployment can redirect sensitive traffic to an attacker-controlled server.

Content

Scanner excerpt · scripts/execute_operation.py (reported line 180)May include surrounding context.

python

req = urllib.request.Request(url=url, method=op["method"], headers=req_headers, data=data)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8")
            try:
                payload = json.loads(raw) if raw else None

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared purpose is audience-fit scoring, but the skill also describes generic operation execution, environment loading, credential handling, and auxiliary utilities. That mismatch can mislead users and reviewers about the real attack surface, hiding access to secrets and arbitrary remote API invocation behind a narrower business description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The skill instructs use of an .env file and execution tooling that loads environment variables, which implies access to local secrets such as API keys. In a skill context, encouraging ambient secret loading without strict scoping can expose credentials to broader code paths than necessary and makes secret handling part of the runtime attack surface.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

## Tooling

Execution commands:
- List operations: `python3 scripts/execute_operation.py --env-file .env list`
- Example interest call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_tiktok_interest --query '{"unique_id":"nike"}'`
- Example language call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_youtube_language --query '{"channel_id":"UC_x5XG1OV2P6uZZ5FSM9Ttw"}'`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The documented environment-loading flow continues into the section defining required environment variables, reinforcing that the skill depends on local secret material being read at runtime. If the skill or its helper scripts are broader than advertised, this creates a clear path for credential exposure or misuse through improperly constrained env access.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

Execution commands:
- List operations: `python3 scripts/execute_operation.py --env-file .env list`
- Example interest call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_tiktok_interest --query '{"unique_id":"nike"}'`
- Example language call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_youtube_language --query '{"channel_id":"UC_x5XG1OV2P6uZZ5FSM9Ttw"}'`

Required environment variables:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

By documenting .env-based configuration alongside API gateway settings, the skill normalizes local credential access without declaring strong controls on how those secrets are consumed. In combination with network-capable execution helpers, this increases the potential for sensitive configuration to be exfiltrated or reused beyond the narrow scoring task.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

Execution commands:
- List operations: `python3 scripts/execute_operation.py --env-file .env list`
- Example interest call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_tiktok_interest --query '{"unique_id":"nike"}'`
- Example language call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_youtube_language --query '{"channel_id":"UC_x5XG1OV2P6uZZ5FSM9Ttw"}'`

Required environment variables:
- `SCRUMBALL_BASE_URL`: API gateway base URL

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/execute_operation.py (reported line 137)May include surrounding context.

python

elif os.getenv("SCRUMBALL_ENV_FILE"):
        candidates.append(Path(os.getenv("SCRUMBALL_ENV_FILE", "")).expanduser())
    else:
        candidates.append(Path.cwd() / ".env")
        candidates.append(SKILL_ROOT / ".env")

    for p in candidates:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/execute_operation.py (reported line 138)May include surrounding context.

python

elif os.getenv("SCRUMBALL_ENV_FILE"):
        candidates.append(Path(os.getenv("SCRUMBALL_ENV_FILE", "")).expanduser())
    else:
        candidates.append(Path.cwd() / ".env")
        candidates.append(SKILL_ROOT / ".env")

    for p in candidates:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/execute_operation.py (reported line 243)May include surrounding context.

python

elif os.getenv("SCRUMBALL_ENV_FILE"):
        candidates.append(Path(os.getenv("SCRUMBALL_ENV_FILE", "")).expanduser())
    else:
        candidates.append(Path.cwd() / ".env")
        candidates.append(SKILL_ROOT / ".env")

    for p in candidates:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/execute_operation.py (reported line 243)May include surrounding context.

python

def main() -> int:
    parser = argparse.ArgumentParser(description="Run operations for this skill")
    parser.add_argument("--env-file", help="Optional .env file path; if omitted, auto-tries ./.env then <skill-root>/.env")

    sub = parser.add_subparsers(dest="cmd", required=True)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes operational capabilities involving environment access, file access, and network use, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an under-specified trust boundary: a host may permit broader execution than users expect, increasing the risk of unintended credential access, local file interaction, or remote transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill sends creator identifiers to external services and retrieves demographic and authenticity profiling data, but it does not warn users that these requests involve third-party transmission and potentially sensitive profiling outputs. This weakens informed consent and increases privacy/compliance risk, especially where profiling or cross-border processing may be regulated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill explicitly directs users to an external domain and states that, on the free tier, requests may go through a hosted gateway that injects credentials server-side. External transmission is expected for this skill category, but the undocumented default gateway behavior increases data handling and trust risks because creator identifiers and API interactions may be routed through third-party infrastructure by default.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

- **Free tier**: a limited number of calls per day, zero-config (no key required — the skill defaults to a hosted gateway that injects the key server-side).
- **When any operation returns HTTP 429, or the response body has `code=429` / contains `quota_exceeded`, you (the assistant) MUST immediately and clearly tell the user** (do not silently retry, do not treat it as a generic error):

  > Free quota exhausted. Register and get your own API key at **https://data.scdata.cc/pricing**, then set the environment variable `SCRUMBALL_API_KEY` to your key (in your host/agent environment or a local `.env`). You can then continue with your own quota.

- The 429 response body usually includes `apply_url` and `env_var` fields you can quote directly.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match many ordinary research requests, which can cause the skill to activate outside its intended scope. In a research-oriented skill that evaluates influencer audiences, this increases the chance of unintended invocation, unnecessary exposure of the skill's behavior, and user confusion about why this skill was selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This JSON manifest contains natural-language/config values that hard-code a specific language locale using "X-Language": "en". Because the file provides no indication that users can choose another language or that the English-only behavior is justified, this is a language/locale policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes the skill as focused on pre-campaign audience quality, follower authenticity, and core audience demographics/interests for creator vetting. These endpoints add 'brand opportunities' and 'content style' analyses, which profile marketing paths and creator social persona rather than audience quality or fake-follower detection, expanding behavior beyond the stated scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These lines set a default language header to English in a manifest/config file, which constitutes a natural-language locale constraint. The file does not show any user-selectable locale option or documented justification for enforcing English, so it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest hard-codes English as the default language for these operations. Since there is no accompanying indication that the user can select a locale or that the restriction is intentionally region-specific, this is a policy-relevant locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file contains Chinese-only natural-language content such as endpoint summaries and success messages, while the optional X-Language header is only present on some endpoints and supports a fixed subset of locales. That can violate a language/locale policy because users are not consistently offered a clear language choice across the documented API surface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a skill focused on pre-campaign audience quality, follower authenticity, and audience demographics/interests for creator vetting. This API guide additionally exposes 'brand_opportunities', 'content_style', 'interactive_behavior', and 'rating_tier' endpoints across Instagram, TikTok, and YouTube, which characterize creator persona and marketing/purchase influence rather than just audience fit or fake-follower analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code creates a stable installation identifier, persists it across runs in the user's home directory or skill directory, and transmits it on every request. For an audience-fit analysis skill, this identifier is not necessary for core functionality and enables cross-session tracking of the user or installation without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script silently writes a persistent identifier to disk in the user's home directory and later transmits it, without any user-facing disclosure. That is a privacy/security issue because it creates durable tracking state outside the apparent scope of the skill's audience-analysis function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code defaults to a remote gateway and may send API credentials, request bodies, query parameters, and custom headers there without clear disclosure to the user. In a creator-vetting skill, uploaded identifiers and account metadata may be sensitive, so silent transmission to a third-party gateway increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The capability matrix presents user-facing natural-language labels in bilingual mixed form, with Chinese first and English glosses in parentheses, but the skill does not explain this language choice or offer an opt-in/alternative. Under the language/locale policy, user-facing language constraints or defaults should be documented or made optional rather than implicitly imposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file contains user-facing natural language such as tags and summaries in Chinese across the API listing, but it does not indicate that the language is optional or region-specific. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest describes pre-campaign audience quality and follower authenticity analysis focused on geography, language, age, gender, interests, and creator comparison. This API index additionally exposes brand_opportunities, content_style, device, interactive_behavior, and rating_tier endpoints, which expand the behavior into broader marketing/personality profiling not stated in the manifest.

Content

No source excerpt is available for this finding.