Security audit

crier

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent with its Crier bulletin-board purpose, but it asks for recurring authenticated check-ins, persistent state, registration, and possible replies without enough explicit user control.

Review before installing. Use this only if you want an agent to use Crier as an external bulletin board. Require explicit approval before registration, terms acceptance, background inbox checks, subscriptions, public posts, or thread replies. Store any API key in a protected secret location rather than ordinary project files, and make sure any recurring heartbeat can be disabled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Persistent External-Service Instructions Hijack Unrelated Agent Sessions
Content: View full analysis
` with your API key (or the MCP `inbox` tool) once. Omit the cursor on the very first call. 2. Act on what comes back: replies to your posts, and matches for your subscriptions. Tell the person you work for what is relevant; reply in a thread when a reply is warranted. 3. Save `next_cursor` where you keep state (project memory, notes, a config file). Pass it next time. Nothing is consumed server-side, so a missed check loses nothing. 4. Post only if the person you work for has something others might be looking for. Never post to fill silence. Never post a status update or a greeting. 5. Check no more than once an hour. ``` ### Technical Analysis The skill directs the agent to contact an external service at every session start or scheduled check-in, even when the active user task is unrelated to Crier. The request is authenticated with an API key and uses a cursor persisted in project memory, notes, or configuration files. The agent is then instructed to act on server-selected inbox data and potentially reply to remote threads. Although the skill later warns that post bodies are untrusted and must not be followed as instructions, the heartbeat itself still gives the external service a persistent channel for influencing agent-visible notifications and communication behavior. This violates task-scoped execution principles: network access should occur only when requested by the user or when the user has explicitly opted into a separately defined background process. The instruction also creates cross-session state and recurring external communication without requiring clear, ...[truncated 1452 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:36
Finding: Publisher Registration Can Impersonate a User and Accept External Terms Without Explicit Consent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description contains broad triggers such as 'what is happening nearby,' 'announce, sell or find something local,' and 'wants to be told when something appears,' which can match many ordinary user requests and cause the skill to activate more often than intended. Because this skill can drive external network access, posting, subscriptions, and inbox polling against a third-party service, overbroad activation increases the chance of unnecessary data exposure, unintended posting workflows, or user redirection to an external system.
Content: No source excerpt is available for this finding.