Alphagbm Company Profile

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for managing AlphaGBM research profiles, but it handles a bearer API key with an unrestricted base-URL override and uses broad activation language around a mutable private workspace.

Install only if you trust AlphaGBM and need an agent to manage private company research profiles. Keep ALPHAGBM_BASE_URL unset unless you intentionally use a trusted AlphaGBM-compatible endpoint, and review profile create, refresh, or archive actions before allowing them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Unrestricted API Base URL Override Can Expose the Bearer Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-35
Vulnerability Type: Arbitrary credentialed endpoint configuration
Risk Level: Medium

Vulnerable Code

markdown

- **API Key**: stored in env `ALPHAGBM_API_KEY` (format `agbm_xxxx…`).
- **Base URL**: default `https://alphagbm.zeabur.app`. Override with env `ALPHAGBM_BASE_URL`.
- If the user has no key, direct them to register at <https://alphagbm.com> and create one at `/api-keys`.
- **Tier requirement**: Free tier = 1 profile, Plus = 10, Pro = 50. Create endpoint returns 403 with `upgrade_required: true` when the cap is hit.

## API Endpoints

All endpoints require `Authorization: Bearer $ALPHAGBM_API_KEY`.

Technical Analysis

The skill permits ALPHAGBM_BASE_URL to override the service endpoint without defining validation requirements, while instructing the agent to attach ALPHAGBM_API_KEY as a bearer token to all API requests.

If an attacker can influence the environment variable, authenticated requests may be redirected to an attacker-controlled host. The skill does not require HTTPS, restrict the destination to trusted hostnames, prohibit IP-literal destinations, or specify safe handling of cross-origin redirects. Consequently, the authorization header could be disclosed to an untrusted endpoint.

This is an insecure configuration pattern rather than embedded malicious behavior. The package contains no scripts or executable payloads, but agents implementing these instructions literally may transmit a secret to an arbitrary destination.

Attack Path

1. An attacker or compromised deployment component sets ALPHAGBM_BASE_URL to an attacker-controlled HTTP or HTTPS endpoint.
2. The user asks the agent to list, create, retrieve, refresh, or archive a company profile.
3. The agent constructs the request using the overridden base URL.
4. Following the skill instructions, the agent includes `Authorization: Bearer $ALPH ...[truncated 976 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict API destinations to an explicit allowlist, with https://alphagbm.zeabur.app as the approved default.
2. If custom endpoints are operationally necessary, require explicit user or administrator approval before sending credentials to a new origin.
3. Require HTTPS and reject plaintext HTTP URLs, embedded credentials, malformed URLs, and unsupported schemes.
4. Reject loopback, link-local, private-network, and IP-literal destinations unless they are explicitly approved for a controlled development environment.
5. Do not forward the Authorization header across cross-origin redirects. Prefer disabling redirects for authenticated requests or revalidate every redirect destination against the allowlist.
6. Validate the final resolved request origin immediately before attaching the bearer token.
7. Separate development and production credentials, and ensure development overrides cannot access production tokens.
8. Use narrowly scoped, revocable, and expiring API tokens where supported.
9. Document secure override behavior directly in the skill, including hostname validation and a prohibition on transmitting credentials to untrusted endpoints.
10. Rotate the API key immediately if requests may already have been sent to an untrusted base URL.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

4. Delete (archive) profile

text

DELETE /api/research/profiles/<TICKER>

Soft-deletes by flipping status to archived. Returns 404 if not found.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger examples include broad phrases like "what's in my research brain" and similar natural-language variants that could match ordinary conversation without a clear, explicit request to invoke this skill. Because the skill can create, refresh, list, and potentially delete persisted user records, ambiguous activation increases the risk of unintended tool use and data modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented condition says the skill should trigger when the user merely mentions generic terms like "知识库", "投研档案", "research brain", or "knowledge base," which is ambiguous and can cause activation absent a concrete action request. In this skill's context, that ambiguity is more dangerous because the connected API supports state-changing operations on a user's private research workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.