social-media-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:56 PM UTC
• Version: 1.0.15

Overview

The skill is mostly a disclosed Crawlora public-data helper, but it needs Review because its authenticated API helper reaches beyond the nine platforms and request methods advertised.

Install only if you are comfortable giving this skill a Crawlora API key and having your research queries sent to Crawlora. Review the endpoint reference first: it includes Bilibili and Patreon despite the main description naming nine platforms, and the helper currently allows POST and broad Facebook paths beyond the documented GET-only route list.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/crawlora.sh:60
• Finding: Executable helper exposes undeclared Bilibili and Patreon capabilities## Vulnerability Details **File Location**: `scripts/crawlora.sh:60-67, 83-86`; supporting documentation at `reference/endpoints.md:9, 437-511` **Vulnerability Type**: Least-privilege violation through capabilities outside the declared Skill scope **Risk Level**: Medium ### Vulnerable Code ```sh /bilibili/anime-home) ;; /bilibili/autocomplete) ;; /bilibili/guochuang-home) ;; /bilibili/must-watch) ;; /bilibili/popular) ;; /bilibili/ranking) ;; /bilibili/vertical-home) ;; /bilibili/weekly) ;; ``` ```sh /patreon/creator) ;; /patreon/creator/tiers) ;; /patreon/explore) ;; /patreon/rss) ;; ``` The endpoint reference confirms that these capabilities are included: ```md **80 endpoints across 11 platform group(s).** ``` ```md ## Bilibili (8) ``` ```md ## Patreon (4) ``` ### Technical Analysis The Skill metadata declares social-media research across nine platforms: Instagram, TikTok, Threads, Bluesky, X, Pinterest, LinkedIn, Facebook, and Reddit. However, the executable route allowlist also permits eight Bilibili endpoints and four Patreon endpoints. Because these additional platforms are not part of the declared functionality, exposing them exceeds the minimum capabilities needed to implement the advertised Skill. Requests to these routes are authenticated using the user's Crawlora API key and may consume that account's credits. The issue does not grant operating-system privileges or allow requests to arbitrary hosts. The helper uses a fixed Crawlora HTTPS origin. The excess privilege is limited to authenticated Crawlora API capabilities outside the Skill's declared platform scope. ### Attack Path 1. An untrusted prompt, workflow, or Agent-generated instruction requests data from a Bilibili or Patreon endpoint. 2. The Agent invokes `scripts/crawlora.sh` with one of the undeclared paths, such as `/patreon/rss`. 3. The helper accepts the path because it appears in its internal allowli ...[truncated 955 chars]
• Remediation: ## Remediation Suggestions 1. Remove all Bilibili and Patreon paths from this Skill's executable allowlist. 2. Remove the corresponding sections from `reference/endpoints.md`. 3. Generate the executable allowlist and endpoint documentation from a Skill-specific manifest containing only the nine declared platforms. 4. Add an automated test that compares the platforms and routes declared in `SKILL.md` against the executable route allowlist. 5. If Bilibili and Patreon support is intentional, explicitly disclose both platforms in the Skill metadata, usage documentation, privacy description, and credit-cost guidance. 6. Consider separating unrelated platform families into distinct Skills and API helpers so each Skill receives only the capabilities necessary for its stated purpose.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlora.sh:44
• Finding: HTTP methods and Facebook routes are authorized more broadly than documented## Vulnerability Details **File Location**: `scripts/crawlora.sh:44-49, 75-76` **Vulnerability Type**: Overbroad route and HTTP-method authorization **Risk Level**: Medium ### Vulnerable Code ```sh case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the social-media-research skill" >&2 exit 2 ;; esac ``` ```sh /facebook/*) ;; /facebook/marketplace/search) ;; ``` ### Technical Analysis The endpoint reference documents the current Skill endpoints as GET operations, but the helper independently permits both GET and POST for every accepted route. It does not bind each route to its documented HTTP method. Consequently, a caller can send an authenticated POST request, including an arbitrary JSON body, to any path accepted by the route allowlist. The `/facebook/*` shell pattern is also broader than the documented `/facebook/{page}` endpoint. In a Bash `case` pattern, `*` can match slash characters, so this rule can accept nested paths such as `/facebook/undocumented/nested/route`. The following exact marketplace rule does not narrow the preceding wildcard. The fixed API base prevents redirection to an attacker-controlled host, and no currently documented state-changing endpoint was identified. Nevertheless, the helper's authorization boundary is broader than the endpoint catalog. If Crawlora currently has, or later adds, an undocumented POST operation under an accepted path, callers could reach it using the victim's API key. ### Attack Path 1. An attacker influences a prompt or workflow that controls arguments supplied to `crawlora.sh`. 2. The attacker selects `-X POST`, an accepted nested Facebook path, and an arbitrary JSON body. 3. The global method check accepts POST without verifying whether that route supports it. 4. The `/facebook/*` pattern accepts the nested path. 5. The helper attaches the victim's API key and sends the authenticated request to Crawlora. 6. ...[truncated 892 chars]
• Remediation: ## Remediation Suggestions 1. Replace the independent method and path checks with an exact route-to-method authorization table. 2. Permit only GET for all endpoints currently documented as GET. 3. Reject POST unless a specific endpoint is explicitly documented and requires it. 4. Replace `/facebook/*` with strict validation for exactly one page-reference segment, or parse and validate the supported full-URL form separately. 5. Enforce path segment counts and conservative character allowlists for every path parameter. 6. Normalize the path before authorization and reject encoded separators, traversal syntax, repeated separators, query fragments, and unexpected nested segments. 7. Add negative tests covering nested Facebook paths, unsupported methods, encoded path separators, and undocumented endpoints. 8. Default to denial when the endpoint manifest and helper implementation differ.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A description-behavior mismatch means the skill may access platforms outside its declared social-media scope, specifically undeclared Bilibili and Patreon endpoints. Hidden or broader-than-declared network behavior undermines trust, can bypass reviewer expectations, and may result in unauthorized data collection or policy violations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill invokes shell-based helper commands (`scripts/crawlora.sh`) but does not declare any tool scope, permissions, or allowed-tools boundaries. That makes the skill's execution capabilities less transparent and weakens policy enforcement, increasing the chance that a consumer permits broader shell access than intended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest describes research across Instagram, TikTok, Threads, Bluesky, X, Pinterest, LinkedIn, Facebook, and Reddit. This reference states the skill uses 80 endpoints across 11 platform groups, and later includes Bilibili and Patreon endpoints, which are not mentioned in the manifest and extend the skill beyond its declared platform scope.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest frames the skill as researching public social-media profiles, posts, engagement, platform search, trending topics, and social listening/competitor research. A dedicated Facebook Marketplace listing search is e-commerce/classifieds research rather than social-media profile/post research, so this capability broadens the skill beyond the behavior users would expect from the manifest.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The inline comment states the helper is limited to the documented social-media route set, but the actual allowlist permits additional unrelated routes. This mismatch is dangerous because reviewers, users, or higher-level agents may rely on the documentation when deciding whether to grant access, leading to over-trust of a broader-capability tool.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper advertises a social-media-research scope, but its allowlist includes additional services such as Bilibili and Patreon that are not described in the manifest. This scope expansion can let callers access unintended third-party data surfaces using the same privileged API key, undermining least privilege and making policy or consent boundaries harder to enforce.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown file states that all requests require sending `x-api-key: $CRAWLORA_API_KEY`, which is a credential-bearing network operation. The reference does not include any user-facing warning about handling secrets or that requests will transmit authenticated data to an external service.

Static analysis

No suspicious patterns detected.