Security audit

Creativault Creator Scraper

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for creator search and outreach, but its updater and credential handling need human review before installation.

Install only if you trust Creativault and can review or disable the self-update path. Keep CV_SKILL_AUTO_UPDATE unset, use an HTTPS Creativault API URL you control or trust, use a scoped API key, confirm recipient lists before sending, and treat exported creator/contact files as sensitive personal data.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/skill_update.mjs:207
Finding: Unauthenticated Remote Self-Update Allows Replacement of Executable Skill Files
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/skill_update.mjs:122
Finding: Remote Manifest Can Delete Files Across the Skill Root
Content: View full analysis
!remotePaths.has(path)) .filter((path) => !isSyncExcluded(path)) .sort((left, right) => left.localeCompare(right)); } ``` ```js // scripts/skill_update.mjs:288-289 const managedRoots = manifest.sync?.delete_missing ? getManagedRoots(manifest) : []; const staleFiles = listMissingLocalFiles(manifestPaths, managedRoots); ``` ```js // scripts/skill_update.mjs:327-337 let deletedFileCount = 0; for (const relativePath of staleFiles) { if (backupAndRemoveFile(relativePath, backupRoot)) { deletedFileCount += 1; pruneEmptyDirectories(dirname(join(skillRoot, relativePath))); } } ``` ```js // scripts/skill_update.mjs:158-170 function backupAndRemoveFile(relativePath, backupRoot) { const target = join(skillRoot, relativePath); if (!existsSync(target) || !statSync(target).isFile()) { return false; } const backup = join(backupRoot, relativePath); mkdirSync(dirname(backup), { recursive: true }); renameSync(target, backup); return true; } ``` ### Technical Analysis The remote manifest controls both the deletion policy and the mana ...[truncated 1985 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/_api_client.mjs:12
Finding: API Key and Operator Identity Can Be Transmitted over Plaintext HTTP or to an Arbitrary Host
Content: View full analysis
- `CV_API_KEY` — Creativault Open API Key (obtain from admin dashboard) - `CV_USER_IDENTITY` — Operator email address - `CV_API_BASE_URL` (optional) — API base URL, defaults to `http://api.creativault.vip` ``` ```js // scripts/_api_client.mjs:12-14 const API_BASE = (process.env.CV_API_BASE_URL || '').replace(/\/+$/, ''); const API_KEY = process.env.CV_API_KEY; const USER_IDENTITY = process.env.CV_USER_IDENTITY || ''; ``` ```js // scripts/_api_client.mjs:93-110 const url = `${API_BASE}${path}`; for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) { let response; try { if (!options.skipUserIdentity) { ensureUserIdentity(); } const headers = { 'Content-Type': 'application/json', 'X-API-Key': API_KEY, 'X-CV-Skill-Name': SKILL_META.name || 'creator-scraper-cv', 'X-CV-Skill-Version': SKILL_META.version || 'unknown', 'X-CV-Skill-Channel': SKILL_META.channel || 'unknown', }; if (!options.skipUserIdentity) { headers['X-User-Identity'] = USER_IDENTITY; } response = await fetch(url, { method: 'POST', headers, body: JSON.stringify(processedBody), }); ``` ### Technical Analysis The documentation specifies a plaintext HTTP endpoint, while the client sends the API key in `X-API-Key` and the operator email in `X-User-Identity`. HTTP does not provide confidentiality or server authentication, allowing an on-path attacker to observe or alter requests and responses. The implementation also accepts any value from `CV_API_BASE_URL` without URL parsing, HTTPS enforcement, or host allowlisting. Consequently, a modified environment can direct credentials and sensitive request bodies to an arbitrary server. There i ...[truncated 1368 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/export_to_csv.mjs:82
Finding: CSV Exporter Allows Arbitrary Writable File Overwrite or Append
Content: View full analysis
flattenObject(r)); // Collect all headers const allHeaders = [...new Set(flatRows.flatMap(r => Object.keys(r)))]; const fileExists = existsSync(outputPath); if (mode === 'overwrite' || !fileExists) { // Write header + data (BOM for Excel UTF-8 compatibility) const bom = '\ufeff'; const headerLine = allHeaders.map(escapeCSV).join(','); const dataLines = flatRows.map(r => rowToCSV(allHeaders, r)).join('\n'); writeFileSync(outputPath, bom + headerLine + '\n' + dataLines + '\n', 'utf-8'); console.error(`[export] ${fileExists ? 'Overwritten' : 'Created'} ${outputPath}, wrote ${rows.length} rows`); } else { // Incremental append: read existing headers const existingContent = readFileSync(outputPath, 'utf-8'); const firstLine = existingContent.split('\n')[0].replace(/^\ufeff/, ''); const existingHeaders = firstLine.split(',').map(h => h.replace(/^"|"$/g, '')); // Check for new columns const newHeaders = allHeaders.filter(h => !existingHeaders.includes(h)); if (newHeaders.length > 0) { console.error(`[export] Warning: new data contains ${newHeaders.length} new column(s) (${newHeaders.join(', ')}), ignored during append`); } // Append using existing header order const dataLines = flatRows.map(r => rowToCSV(existingHeaders, r)).join('\n'); appendFileSync(outputPath, dataLines + '\n', 'utf-8'); console.error(`[export] Appended ${rows.length} rows to ${outputPath}`); } ``` ### Technical Analysis The `output` argument is resolved directly into an absolute path without restricting it to an export directory. Absolute paths and traversal-containing relative paths are ...[truncated 1625 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/export_to_csv.mjs:35
Finding: CSV Export Does Not Neutralize Spreadsheet Formula Injection
Content: View full analysis
escapeCSV(row[h])).join(','); } ``` ```js const flatRows = rows.map(r => flattenObject(r)); const allHeaders = [...new Set(flatRows.flatMap(r => Object.keys(r)))]; if (mode === 'overwrite' || !fileExists) { const bom = '\ufeff'; const headerLine = allHeaders.map(escapeCSV).join(','); const dataLines = flatRows.map(r => rowToCSV(allHeaders, r)).join('\n'); writeFileSync(outputPath, bom + headerLine + '\n' + dataLines + '\n', 'utf-8'); } else { const dataLines = flatRows.map(r => rowToCSV(existingHeaders, r)).join('\n'); appendFileSync(outputPath, dataLines + '\n', 'utf-8'); } ``` ### Technical Analysis The escaping routine correctly handles CSV delimiters, double quotes, and newlines, but it does not address spreadsheet formula interpretation. Spreadsheet applications may treat cells beginning with characters such as `=`, `+`, `-`, or `@` as formulas. Leading tab or carriage-return characters can also be used to bypass simplistic checks. Creator profile data is externally controlled. Fields such as nicknames, biographies, URLs, or other returned attributes can therefore begin with formula syntax. Quoting a value according to CSV syntax does not necessarily prevent spreadsheet software from evaluating it as a formula. ### Attack Path 1. A creator or another upstream data source places a formula-like value in a field that the Skill collects, such as `=HYPERLINK(...)`, `+SUM(...)`, or another spreadsheet expression. 2. The API returns this value in creator ...[truncated 998 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (41)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
node scripts/skill_update.mjs --check

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
node scripts/skill_update.mjs --check

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
node scripts/skill_update.mjs --check

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
node scripts/generate_manifest.mjs --note "Describe this release"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_manifest.mjs (reported line 27)May include surrounding context.
js
const excludedPathNames = new Set([ '.DS_Store', 'Thumbs.db', '.env', ]); function readJSON(path) {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/skill_update.mjs (reported line 118)May include surrounding context.
js
const excludedPathNames = new Set([ '.DS_Store', 'Thumbs.db', '.env', ]); function readJSON(path) {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/skill_update.mjs (reported line 119)May include surrounding context.
js
const excludedPathNames = new Set([ '.DS_Store', 'Thumbs.db', '.env', ]); function readJSON(path) {

Self-Modification

High

Category: Rogue Agent
Confidence: 96% confidence
Finding: A self-modifying/self-updating script is a genuine security concern here because it allows the skill to replace its own local files from remote content. In the context of a creator scraping/outreach skill, this capability is unnecessary and increases the blast radius of any upstream compromise into arbitrary code or behavior changes on the client side.
Content: Scanner excerpt · scripts/skill_update.mjs (reported line 2)May include surrounding context.
js
#!/usr/bin/env node // Check and update this skill from a remote manifest. // // Usage: // node scripts/skill_update.mjs --check

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises capabilities that require environment-variable access and outbound network access, but it does not declare any explicit tool scope or permission boundary. In an agent environment, this can lead to overbroad authority being granted implicitly, making it easier for the skill to access secrets and perform external actions without clear operator review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly promotes scraping creator data from multiple social platforms and sending batch outreach emails, but it provides no visible safeguards around consent, privacy, lawful data use, rate limits, or recipient impact. In context, this makes the skill more dangerous because it combines mass data collection with automated outbound communication, increasing the risk of privacy abuse, spam, and platform-policy violations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation keywords are broad enough to match generic requests like outreach or send email, which can cause the skill to activate in contexts beyond creator discovery. Because this skill includes batch scraping and outbound messaging behavior, overly broad routing increases the chance of unintended external actions or privacy-invasive collection being triggered by ambiguous prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly supports exporting scraped creator data into downloadable xlsx/csv/html files and sharing file links, but the description does not warn users that collected data may contain personal information or sensitive profile/contact data. In a scraping and outreach context, omission of this warning increases the likelihood of inappropriate collection, distribution, or retention of personal data, especially when users may treat generated download links as low-risk artifacts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase list contains very broad terms such as 'similar creators', 'lookalike', and especially generic discovery phrases in both Chinese and English. In an agentic system, overly broad activation terms can cause this skill to be selected for unrelated user requests, leading to unintended scraping or creator-search actions and increasing the chance of privacy, compliance, or policy-violating behavior in contexts where the user did not explicitly request it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes broad, everyday phrases such as 'search creators' and 'influencer discovery', which can cause the agent to invoke this skill in loosely related contexts without strong user intent. In this skill, accidental activation is more concerning because it can lead into creator scraping and downstream outreach workflows, increasing the chance of unintended data collection or contact actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill metadata includes very broad invocation phrases such as '建联, 发邮件, email outreach, send email, outreach', which can match ordinary user requests without sufficient scoping to the Creativault workflow. In a high-risk skill that can trigger email sending, overly generic triggers increase the chance of unintended routing into an outbound-contact capability, potentially leading to accidental outreach or user confusion about what action will be taken.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The decision rules map ambiguous natural-language inputs like '发邮件', '建联', 'reach out', '待办', and '沟通历史' directly to operational scripts without clear scope boundaries or eligibility checks. Even though the document later requires confirmation before sending, ambiguous routing at the skill-selection stage can still cause unintended invocation of sensitive outreach functionality and increase the risk of acting on incomplete or mismatched user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This is a markdown file, so SQP-2 applies to missing safety/privacy warnings in the description. The document instructs users to send X-API-Key and X-User-Identity headers and later to provide webhook_url and handle authenticated file_url exports, but it does not warn that these values may expose credentials, identity, or exported creator/contact data if logged or shared improperly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Line L03 states that when the user says a country name in Chinese, the agent must convert it to an ISO code, and the document overall is written as a Chinese-only mapping reference. There is no indication that other languages are accepted or that Chinese is an optional locale, which can violate a language/locale policy requiring user choice or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file is written as an operational instruction and states that the agent should act when the user provides Chinese language names. That imposes a Chinese-language expectation without any user opt-in or explicit note that the skill is intentionally region- or locale-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file documents retrieval of direct contact details (email, WhatsApp, Line, Zalo) together with creator profile and audience analytics, but provides no privacy constraints, consent requirements, use limitations, or anti-abuse guidance. In the context of a skill explicitly designed for scraping creators and sending outreach at scale, that omission materially increases the risk of unsolicited contact, profiling, and misuse of personal data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code performs a POST request and includes both the request body and an X-User-Identity header when enabled. While the module has internal comments and error handling, it does not provide a user-facing disclosure here that user/system data is transmitted to an external API.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The client can automatically invoke a local update script via child_process when server-supplied metadata indicates an update and the CV_SKILL_AUTO_UPDATE flag is enabled. Even though the executed path is local, this creates a remote-influenced execution path in a scraping/outreach skill where self-modification is not essential, increasing supply-chain and unintended code execution risk if the update script or package contents are tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The auto-update path launches a subprocess during normal API handling without a strong user-facing confirmation at the point of execution. In the context of a data-collection and outreach skill, this hidden execution behavior is riskier because a remote service response can influence local code changes and process spawning, which users may not expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs a network/API call to send emails, which transmits recipient identifiers, email addresses, and message content. Although the header documents parameters, it does not clearly warn the user that running the script will actually send outbound email and transmit this data to an external service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s natural-language documentation and runtime status messages are entirely in Chinese, including usage instructions and progress output. This imposes a specific language on users without any opt-in, language selection, or documented justification that the skill is China/Chinese-specific.
Content: No source excerpt is available for this finding.