Pipintama Boards

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:08 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for creating hosted Pipintama boards, but it sends user content to an external service and makes boards shareable by default without requiring user confirmation for sensitive content.

Install only if you are comfortable sending board source content to Pipintama and receiving shareable board links by default. Avoid using it for secrets, credentials, regulated data, private architecture, customer data, or proprietary plans unless you explicitly request private visibility and have reviewed the service's data handling expectations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:46
• Finding: User Content Is Transmitted to an External Service Without a Sensitivity Check## Vulnerability Details **File Location**: `SKILL.md`, lines 46-54 **Vulnerability Type**: Uncontrolled Sensitive Data Transmission **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Core workflow 1. Understand the user request and decide whether a hosted board is useful. 2. Choose the simplest correct board mode. 3. Build a concise board title. 4. Preserve the user intent in `source_text` instead of rewriting the task into something unrelated. 5. Default visibility to `shared` unless the user explicitly wants `public` or `private`. 6. Do not pass `workspace_id` unless the user explicitly provides one. Let the authenticated API key determine the workspace. 7. Call the MCP tool that matches the job. 8. Return the hosted viewer URL first. 9. Add one short sentence explaining what the board contains. ``` ### Technical Analysis The skill instructs the agent to preserve user-supplied content in `source_text` and then submit that content through a hosted MCP service at `https://api.pipintama.com/mcp`. External transmission is necessary for the declared hosted-board functionality, but the workflow lacks controls to identify or remove sensitive information before submission. There is no requirement to warn the user that their content will be processed by a third party, obtain confirmation before transmission, redact secrets, or reject sensitive material such as API keys, credentials, personal information, internal architecture, customer data, or proprietary business processes. Consequently, the skill can transfer more information than is minimally necessary to create a useful board. This is a privacy and data-governance issue rather than evidence of hidden exfiltration. The external endpoint and authentication model are disclosed in the documentation, and no covert transmission mechanism was found. ### Attack Path 1. A user asks the agent to create a board from text containing confidential or regulated i ...[truncated 1016 chars]
• Remediation: ## Remediation Suggestions 1. Explicitly disclose that board content will be sent to the Pipintama external service before the first transmission. 2. Require affirmative user confirmation when content may contain personal, confidential, regulated, or proprietary information. 3. Add preflight detection for common secrets, including API keys, access tokens, passwords, private keys, connection strings, and authentication headers. 4. Redact or replace unnecessary identifiers and sensitive values before populating `source_text`. 5. Instruct the agent to summarize sensitive source material using the minimum content necessary rather than preserving it verbatim. 6. Document the service's retention, deletion, logging, and data-processing policies or direct users to those policies before submission. 7. Provide a non-hosted or prose-only fallback when the user does not consent to external processing.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98
• Finding: Shared-by-Default Board Visibility Violates Least-Privilege Access## Vulnerability Details **File Location**: `SKILL.md`, lines 98-104 **Vulnerability Type**: Insecure Default Access Control **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Visibility rules - default to `shared` - use `public` only when the user explicitly wants an open link - use `private` only when the user explicitly asks for restricted access If a board needs to be shareable and is not already shared, call `share_board`. ``` ### Technical Analysis The skill makes every newly created board shareable unless the user expressly requests private visibility. This is contrary to least-privilege and privacy-by-default principles. A user who does not know about the available visibility settings may reasonably assume that newly created content remains restricted to their authenticated account. Shared access appears to rely on a tokenized viewer URL. Such bearer-style links can grant access to anyone who obtains the token. They can leak through conversation histories, browser history, copied messages, screenshots, referrer data, application logs, monitoring systems, or accidental forwarding. The behavior is broader than necessary for board creation. A private board satisfies the core creation functionality; sharing is a separate privilege that should be enabled only when the user requests it. ### Attack Path 1. A user submits confidential content and requests a hosted board without specifying visibility. 2. The skill creates the board with `shared` visibility. 3. The resulting tokenized viewer URL is returned in the conversation. 4. The URL is copied, logged, forwarded, captured, or otherwise exposed to another party. 5. The party possessing the share URL accesses the board without needing the original user's API credentials. ### Impact Assessment The issue can allow unauthorized read access to hosted board content. It does not provide local system privileges, account-level administrative access, ...[truncated 331 chars]
• Remediation: ## Remediation Suggestions 1. Change the default visibility from `shared` to `private`. 2. Require explicit user authorization before creating a shared or public board. 3. Clearly explain the access implications of shared links, including that anyone possessing the token may be able to view the board. 4. Return a private authenticated viewer URL by default where the platform supports it. 5. Add expiration, revocation, and rotation controls for share tokens. 6. Avoid placing share tokens in logs, analytics events, telemetry, or unnecessarily persistent conversation content. 7. Provide an easy workflow to revoke sharing and restore private visibility. 8. Keep `public` visibility restricted to explicit user requests, as the current instructions already require.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

External Transmission

Medium

• Category: Data Exfiltration

Content

Primary MCP endpoint:

- `https://api.pipintama.com/mcp`

Access model:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Primary MCP endpoint:

- `https://api.pipintama.com/mcp`

Access model:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Primary MCP endpoint:

- `https://api.pipintama.com/mcp`

Access model:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Primary MCP endpoint:

- `https://api.pipintama.com/mcp`

Access model:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly defaults board visibility to `shared`, which creates link-accessible resources unless the user opts out. That can expose user-provided content to unintended recipients, especially if the assistant creates boards containing sensitive plans, system diagrams, or internal workflows without clearly warning about the sharing model.

Static analysis

No suspicious patterns detected.