Influencer Audience & Follower Authenticity

• Outcome: Review
• Latest audit: Aug 24, 2026 · 8:43 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent influencer-audience API client, but it needs review because it creates a persistent tracking identifier and sends it with user queries to a configurable remote gateway.

Install only if you are comfortable sending creator identifiers, campaign-fit queries, optional custom headers, and a stable install identifier to the configured Scrumball gateway. Use a dedicated API key, keep .env files out of source control, avoid overriding SCRUMBALL_BASE_URL unless you trust the endpoint, and treat audience-demographic outputs as sensitive inferred analytics.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (11)

Tainted flow: 'req' from os.getenv (line 178, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = urllib.request.Request(url=url, method=op["method"], headers=req_headers, data=data)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8")
            try:
                payload = json.loads(raw) if raw else None

• Confidence: 95% confidence
• Finding: The code allows the network destination to be fully controlled by environment variable `SCRUMBALL_BASE_URL` and then sends request headers, body/query data, and the generated `x-install-id` to that endpoint. In an agent/runtime context, environment variables are part of the trust boundary, so this creates an SSRF/exfiltration path if the base URL is changed to an attacker-controlled or internal host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation advertises code-driven behavior that reads environment files, accesses the network, and may read/write local state, but it does not declare permissions or clearly scope those capabilities. This creates a trust and review gap: a user may invoke what appears to be a simple analytics skill without realizing it can access credentials and transmit data externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is audience-fit scoring, but the referenced tooling appears to provide generic execution of operations from an external manifest, environment loading, diagnostics, and persistent identifier behavior that go beyond the declared function. That mismatch is dangerous because it can hide broader remote-call and tracking capabilities behind an innocuous analytics description, reducing informed consent and increasing the chance of misuse.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill generates and persistently stores a cross-run installation identifier in the user's home directory or skill directory, then transmits it on every request as `x-install-id`. For an audience-fit scoring skill, this persistence is not necessary for core functionality and enables cross-session tracking and correlation of user activity without clear consent or disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs users to send creator identifiers and audience-analysis queries to remote APIs without a privacy notice describing what data leaves the environment, who receives it, and how it is handled. Even if the identifiers are public handles, the aggregation of campaign targeting criteria and creator-vetting activity can be commercially sensitive and should be disclosed before transmission.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation tells users to place an API key in environment variables and local .env files but does not warn about protecting secrets from source control, shared workspaces, logs, or prompt leakage. This increases the chance of credential exposure, especially in agent environments where files and command output may be visible to other tools or users.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are broad enough to match common user requests such as 'audience analysis' or 'creator comparison', which can cause this skill to activate when a more specific or different tool was intended. In a routing or agent-selection system, that can lead to misfires, unnecessary data exposure to the skill, or incorrect results, though the file itself contains no direct code execution or privilege escalation risk.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: Several operations hard-code the X-Language header to English, removing user control over output language and potentially causing incorrect analysis, misleading results, or silent exclusion of non-English contexts. In an audience-analysis skill, forced language normalization can skew interpretation and create fairness, transparency, and data-quality risks, especially when users may assume locale-sensitive analysis.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation exposes endpoints for demographic, behavioral, geographic, language, age, gender, device, and follower-authenticity analytics without any privacy, sensitivity, consent, retention, or acceptable-use guidance. In a creator-vetting context, this omission can normalize misuse of inferred personal or quasi-personal audience data and increase the risk of noncompliant profiling, discriminatory targeting, or unauthorized surveillance-style analysis.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code transmits user-supplied query/body fields, custom headers, authorization material, and a persistent install ID to a remote service without any disclosure or consent mechanism in the code path. In this skill context, those payloads may include creator/account identifiers and potentially sensitive operational metadata, making silent transmission materially relevant from a privacy and data-handling perspective.

Credential Access

High

• Category: Privilege Escalation

Content

## Tooling

Execution commands:
- List operations: `python3 scripts/execute_operation.py --env-file .env list`
- Example interest call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_tiktok_interest --query '{"unique_id":"nike"}'`
- Example language call: `python3 scripts/execute_operation.py --env-file .env call --operation audience_youtube_language --query '{"channel_id":"UC_x5XG1OV2P6uZZ5FSM9Ttw"}'`

• Confidence: 95% confidence
• Finding: The skill explicitly directs loading credentials from a local .env file, which means the skill ecosystem is expected to access secrets from disk. In an agent setting, encouraging local plaintext secret storage without safeguards can expose API keys through repository commits, broad file-read permissions, debugging output, or other tools running in the same environment.

Static analysis

No suspicious patterns detected.