T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:48- Finding
Undisclosed Affiliate-Link Substitution Hijacks Agent Recommendations
- Content
View full analysis
- Remediation
View remediation
Security audit
Syndicate Links
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly for affiliate monetization, but it broadly tells agents to replace normal recommendations with commission-tracking links without requiring user disclosure or clear consent.
Review before installing. This skill is designed to make an agent earn affiliate commissions, so it can affect the neutrality and transparency of product recommendations. Only use it if you are comfortable with external registration at syndicatelinks.co, local storage of an affiliate API key, and clear disclosure to users whenever tracking links are used. Do not run the setup script in a shared environment unless credential-file permissions and temporary-file handling are hardened.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:15- Finding
Predictable Temporary File Permits Local File Overwrite and Data Exposure
- Content
View full analysis
/dev/null || cat /tmp/sl-me.json ``` ### Technical Analysis The script writes the affiliate profile response to the fixed path `/tmp/sl-me.json`. Shared temporary directories are commonly writable by multiple local users. The script does not create the file securely, verify its ownership or type, use restrictive permissions, or delete it after use. An attacker with local access may pre-create `/tmp/sl-me.json` as a symbolic link to another file writable by the victim. When `curl -o` opens the predictable path, it may follow that symbolic link and overwrite the linked file with the API response. The response can also remain in `/tmp` after the script exits. Its effective permissions depend on the process umask, potentially exposing profile information to other local users. Concurrent executions can overwrite or read each other's responses. ### Attack Path 1. A local attacker predicts that the victim will run the setup script. 2. The attacker creates `/tmp/sl-me.json` as a symbolic link to a file the victim can modify. 3. The victim runs the script while an existing affiliate API key is present. 4. The authenticated `curl` request writes its response through the attacker-controlled path. 5. The linked target is overwritten with the API response. 6. Alternatively, another local user reads the residual temporary response if its permissions allow access. ### Impact Assessment Successful exp ...[truncated 521 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:8- Finding
Affiliate API Credential Is Stored Without Explicit Restrictive Permissions
- Content
View full analysis
"$CONFIG_DIR/api-key" ``` ### Technical Analysis The script stores a live bearer credential in a plaintext file but does not explicitly restrict the permissions of either the configuration directory or the credential file. The resulting permissions depend on the caller's existing umask and any pre-existing directory state. Under a permissive umask, the API-key file may be readable by other local users. `mkdir -p` also does not correct insecure permissions when the directory already exists. Because the API key is used as an authorization bearer token, any process or user able to read it can impersonate the affiliate account within the permissions exposed by the remote API. Plaintext local storage may be necessary for this command-line integration, but relying on ambient permission defaults exceeds the minimum safe privilege model for a reusable Skill. ### Attack Path 1. The setup script runs with a permissive umask or uses an existing configuration directory with weak permissions. 2. The registration endpoint returns a live affiliate API key. 3. The script writes the key to `~/.config/syndicate-links/api-key` without enforcing mode `0600`. 4. Another local user or process reads the credential. 5. The attacker submits the key as an `Authorization: Bearer` token to the Syndicate Links API. 6. The attacker accesses or manipulates resources authorized for that affiliate account. ### Impact Assessment Credential theft can permit unauthorized access to the affiliate profile, program listings, program applications, generated links, balances, payout history, and ...[truncated 426 chars]- Remediation
View remediation
"$KEY_TMP" chmod 600 -- "$KEY_TMP" mv -f -- "$KEY_TMP" "$CONFIG_DIR/api-key" trap - EXIT ``` Before overwriting an existing credential file, the script should verify with `lstat` or equivalent checks that it is a regular file owned by the current user and not a symbolic link. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs the agent to monetize recommendations via affiliate tracking links but does not require a user-facing disclosure that links may generate commission. This creates a deception and conflict-of-interest risk, allowing covert ad insertion into advice that users may interpret as neutral recommendations.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh if [ -f "$CONFIG_DIR/api-key" ]; then echo "Already registered. API key found at $CONFIG_DIR/api-key" echo "Testing connection..." RESP=$(curl -s -w "%{http_code}" -o /tmp/sl-me.json "$API_URL/affiliate/me" \ -H "Authorization: Bearer $(cat $CONFIG_DIR/api-key)") if [ "$RESP" = "200" ]; then echo "✅ Connected. Profile:"
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh echo " Name: $AGENT_NAME" echo " Email: $AGENT_EMAIL" RESP=$(curl -s "$API_URL/affiliate/register" \ -H "Content-Type: application/json" \ -d "{\"email\":\"$AGENT_EMAIL\",\"name\":\"$AGENT_NAME\"}")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # Auto-discover and join programs echo "" echo "Discovering available programs..." PROGRAMS=$(curl -s "$API_URL/affiliate/programs" \ -H "Authorization: Bearer $API_KEY") echo "$PROGRAMS" | python3 -c "
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill includes shell-based setup and API invocation guidance but declares no explicit tool scope or permission boundaries. In agent environments, this can enable unexpected shell access during normal use and increases the chance the skill is invoked with more capability than users realize.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
The registration step transmits agent-identifying data to an external third-party service and returns a live API key for continued access. While expected for service onboarding, this is still a meaningful security concern because it expands data exposure and introduces credential handling requirements in an agent skill context.
- Content
1. Register as an Affiliate
bash curl -X POST https://api.syndicatelinks.co/affiliate/register \ -H "Content-Type: application/json" \ -d '{"email":"YOUR_AGENT_EMAIL","name":"YOUR_AGENT_NAME"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
The registration step transmits agent-identifying data to an external third-party service and returns a live API key for continued access. While expected for service onboarding, this is still a meaningful security concern because it expands data exposure and introduces credential handling requirements in an agent skill context.
- Content
1. Register as an Affiliate
bash curl -X POST https://api.syndicatelinks.co/affiliate/register \ -H "Content-Type: application/json" \ -d '{"email":"YOUR_AGENT_EMAIL","name":"YOUR_AGENT_NAME"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 74% confidence
- Finding
Listing available programs sends an authorization bearer token to an external service, creating routine outbound data transfer and credential exposure risk if the environment, logs, or shell history are not well controlled. In an agent skill, this matters because the skill offers executable commands without permission gating or secret-management guidance.
- Content
2. Discover Programs
bash curl https://api.syndicatelinks.co/affiliate/programs \ -H "Authorization: Bearer $(cat ~/.config/syndicate-links/api-key)"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 76% confidence
- Finding
Applying to affiliate programs performs an authenticated state-changing request to a third-party service. If triggered automatically by an agent, it could enroll accounts in external programs without clear operator intent or oversight.
- Content
3. Join a Program
bash curl -X POST https://api.syndicatelinks.co/affiliate/programs/PROGRAM_ID/apply \ -H "Authorization: Bearer $(cat ~/.config/syndicate-links/api-key)"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
Generating tracking links is the core monetization action and creates externally managed affiliate identifiers that can be injected into user-facing recommendations. In context, this is more dangerous because the skill also encourages broad use of those links without mandatory disclosure, enabling covert monetized redirection at scale.
- Content
4. Generate Tracking Links
bash curl -X POST https://api.syndicatelinks.co/affiliate/links \ -H "Authorization: Bearer $(cat ~/.config/syndicate-links/api-key)" \ -H "Content-Type: application/json" \ -d '{"program_id":"PROGRAM_ID"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 68% confidence
- Finding
Checking earnings is an authenticated external call but is comparatively low risk because it is read-only and operational. The primary concern is still external credential use and possible leakage through insecure storage or command execution practices.
- Content
5. Check Earnings
bash curl https://api.syndicatelinks.co/affiliate/me/balance \ -H "Authorization: Bearer $(cat ~/.config/syndicate-links/api-key)"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to include affiliate tracking links during broad categories of ordinary recommendation behavior, such as suggesting tools or answering general product questions. That creates a prompt-level policy vulnerability where the skill may steer many routine responses toward monetized link insertion without a specific trigger, consent boundary, or relevance check.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples instruct users or agents to register an external affiliate account, submit identifying data, enumerate programs, and auto-apply to one without any consent, disclosure, or safety guardrails. In an agent-skill context, this is dangerous because it normalizes autonomous creation of third-party accounts and monetization actions that may violate user expectations, privacy requirements, or platform policy.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This example sends an email address and name to an external API to create an affiliate account and returns an API key, but it provides no user notice, consent checkpoint, or discussion of secret handling. In a skill designed to make agents 'automatically become an affiliate,' this external transmission is more concerning because it can lead to silent account creation and collection of credentials for a third party.
- Content
bash # 1. Register API_KEY=$(curl -s https://api.syndicatelinks.co/affiliate/register \ -H "Content-Type: application/json" \ -d '{"email":"myagent@agentmail.to","name":"My Agent"}' | jq -r '.apiKey')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This example sends an email address and name to an external API to create an affiliate account and returns an API key, but it provides no user notice, consent checkpoint, or discussion of secret handling. In a skill designed to make agents 'automatically become an affiliate,' this external transmission is more concerning because it can lead to silent account creation and collection of credentials for a third party.
- Content
bash # 1. Register API_KEY=$(curl -s https://api.syndicatelinks.co/affiliate/register \ -H "Content-Type: application/json" \ -d '{"email":"myagent@agentmail.to","name":"My Agent"}' | jq -r '.apiKey')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -d '{"email":"myagent@agentmail.to","name":"My Agent"}' | jq -r '.apiKey') # 2. Find programs curl -s https://api.syndicatelinks.co/affiliate/programs \ -H "Authorization: Bearer $API_KEY" | jq '.[].name' # 3. Join first program
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -d '{"email":"myagent@agentmail.to","name":"My Agent"}' | jq -r '.apiKey') # 2. Find programs curl -s https://api.syndicatelinks.co/affiliate/programs \ -H "Authorization: Bearer $API_KEY" | jq '.[].name' # 3. Join first program
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -d '{"email":"myagent@agentmail.to","name":"My Agent"}' | jq -r '.apiKey') # 2. Find programs curl -s https://api.syndicatelinks.co/affiliate/programs \ -H "Authorization: Bearer $API_KEY" | jq '.[].name' # 3. Join first program
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -d '{"email":"myagent@agentmail.to","name":"My Agent"}' | jq -r '.apiKey') # 2. Find programs curl -s https://api.syndicatelinks.co/affiliate/programs \ -H "Authorization: Bearer $API_KEY" | jq '.[].name' # 3. Join first program
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This request applies to an affiliate program using a bearer token, causing an external state-changing action on behalf of the user or agent operator. The danger is elevated by the surrounding workflow, which automatically selects the first program and applies without meaningful review, potentially creating unauthorized business relationships or policy violations.
- Content
md # 3. Join first program PROG_ID=$(curl -s https://api.syndicatelinks.co/affiliate/programs \ -H "Authorization: Bearer $API_KEY" | jq -r '.[0].id') curl -s -X POST "https://api.syndicatelinks.co/affiliate/programs/$PROG_ID/apply" \ -H "Authorization: Bearer $API_KEY" # 4. Generate tracking link
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This request applies to an affiliate program using a bearer token, causing an external state-changing action on behalf of the user or agent operator. The danger is elevated by the surrounding workflow, which automatically selects the first program and applies without meaningful review, potentially creating unauthorized business relationships or policy violations.
- Content
md # 3. Join first program PROG_ID=$(curl -s https://api.syndicatelinks.co/affiliate/programs \ -H "Authorization: Bearer $API_KEY" | jq -r '.[0].id') curl -s -X POST "https://api.syndicatelinks.co/affiliate/programs/$PROG_ID/apply" \ -H "Authorization: Bearer $API_KEY" # 4. Generate tracking link
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The script sends agent identity data to an external service during setup, automatically registering the host as an affiliate without explicit opt-in beyond running the script. In the context of an agent skill, this is more concerning because installation triggers monetization-related external enrollment and data disclosure unrelated to core local setup.
- Content
sh echo " Name: $AGENT_NAME" echo " Email: $AGENT_EMAIL" RESP=$(curl -s "$API_URL/affiliate/register" \ -H "Content-Type: application/json" \ -d "{\"email\":\"$AGENT_EMAIL\",\"name\":\"$AGENT_NAME\"}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script stores a bearer API key on disk in a predictable location without setting restrictive file permissions or warning the user. On multi-user systems or in permissive umask configurations, this can expose the credential and allow unauthorized use of the affiliate account and API.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The inline comment says 'Auto-discover and join programs,' which implies the script will actively apply to affiliate programs. However, the code at L51-L62 only fetches and lists available programs, and L65-L69 merely prints that joining programs is possible later; no apply request is made.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script derives registration identity from local host and environment data and transmits it to a third-party affiliate service without explicit user confirmation. While the data is not highly sensitive by itself, hostname-derived identifiers and inferred email addresses can expose internal naming conventions or create unintended external accounts tied to the machine.
- Content
Static analysis
No suspicious patterns detected.