Security audit

Meme Token Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a meme-token analysis tool, but its package contains mismatched implementation paths and risky local helper/API surfaces that users should review before installing.

Install only if you are comfortable with a Review-level package that sends token queries to external search/LLM/image services and includes legacy Python service code. Before using it in a sensitive workspace, remove or restrict the eval-based environment scripts, disable raw request-body logging, confirm whether image generation is intended, and avoid entering private watchlists, wallet identifiers, credentials, or proprietary research terms.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The report makes a verifiably false security/compliance claim by asserting the skill documentation is 100% English with zero Chinese characters, while the surrounding skill metadata clearly contains substantial Chinese text. False review assertions can mislead publishers, downstream reviewers, or automated trust workflows into approving content under incorrect assumptions, undermining the integrity of the review process.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The report claims there is no local file persistence and that all operations are stateless, yet it simultaneously documents multiple nodes using COZE_WORKSPACE_PATH, which strongly suggests workspace file access. This inconsistency is dangerous because it can hide data handling and persistence risks from reviewers and users, causing them to underestimate exposure of searched content, generated artifacts, or intermediate data.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The documented workflow expands from sentiment-based token analysis into speculative image generation and then feeds that generated image back into the analysis path. In this financial-themed context, adding synthetic visual content can bias the model toward fabricated signals and produce outputs that appear more evidence-based than they are, increasing the risk of misleading users.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill claims it will not hallucinate when data is unavailable, yet the workflow still generates a speculative image and asks the LLM to analyze it even when search results are empty. In an investment-adjacent tool, this can create authoritative-looking but evidence-free token ratings, directly undermining the no-hallucination claim and potentially influencing risky user decisions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This script retrieves all project environment variables via a workload identity client and prints them as shell export commands, which is operationally sensitive behavior unrelated to a meme-token analysis skill. In this context, the mismatch increases risk because it can expose secrets such as API keys or tokens to whoever runs the helper or to logs/shell history, expanding access beyond the minimum needed for the skill’s stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script sources another shell file and then constructs a shell command from user-controlled arguments before executing it with eval. This creates a credible command-injection path, especially because the -i input is directly embedded into the command string and shell parsing is re-applied by eval, which is dangerous regardless of the skill's meme-token analysis purpose.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The graph wires in an `image_gen` stage even though the skill is described as a meme-token sentiment/rating analyzer, creating a capability mismatch between declared behavior and actual execution. Undeclared image-generation functionality increases attack surface, may trigger unnecessary external model/tool usage, and can expose users to unexpected data handling or cost-generating behavior.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The node performs image-generation using a prompt derived from user-controlled token input, but this capability is not reflected in the stated meme-token analysis manifest. Hidden or undocumented capabilities are dangerous because they expand the skill’s behavior beyond user and platform expectations, can trigger unintended external model/API calls, and may expose the system to policy, cost, or content-generation risks without explicit disclosure.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file exposes multiple generic execution surfaces (/run, /stream_run, /cancel, /node_run, /v1/chat/completions, /graph_parameter) that go well beyond a narrowly scoped meme-token analyzer. This increases attack surface and may allow callers to invoke arbitrary workflow or agent behavior inconsistent with the advertised purpose, especially if underlying graph/node logic has higher-privilege tools or broader capabilities.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: run_node allows execution of an arbitrary node by caller-supplied node_id, compiling a single-node graph dynamically from internal graph metadata. If sensitive or unsafe nodes exist, an attacker may bypass normal workflow guardrails, trigger internal-only functionality, or access privileged tools directly.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The graph_parameter endpoint exposes internal input/output schema details for the graph, which aids reconnaissance by revealing internal structure and expected parameters. While not directly code execution, it lowers the effort needed to craft effective requests against broader execution endpoints.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The OpenAI-compatible chat completions endpoint presents the service as a general-purpose chat interface rather than a constrained meme-token analyzer. If the underlying handler can access broader tools or graph functions, this can enable use outside the declared scope and increase abuse potential.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This file implements broad file ingestion capabilities including remote downloads, local file reads, and parsing of PDFs, Office files, CSV, and text, which are unrelated to a meme-token sentiment analysis skill. Unnecessary file-handling primitives expand the attack surface and can be repurposed for data access, exfiltration, or staging follow-on behavior if exposed through agent inputs.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The File model explicitly allows either remote URLs or local filesystem paths, and downstream code reads local files directly when the URL is not http/https. In a meme-token analyzer, arbitrary local file access is unjustified and can expose sensitive host data if an attacker can supply paths such as configuration files, secrets, or system files.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documentation encourages users to submit arbitrary token names and states the system uses real-time web sentiment and image generation, but it does not clearly warn that user-provided strings may be sent to external search or generation services. This creates a privacy and transparency issue: users may unknowingly disclose sensitive watchlists, proprietary research terms, or other confidential inputs to third parties.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: Broad trigger phrases tied to ordinary investment questions can cause the skill to activate unexpectedly in conversations that did not intend to invoke an external analysis workflow. That is risky because it may send user queries to third-party services, produce financial-style recommendations in sensitive contexts, or override the host assistant's normal caution boundaries.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill states that it uses real-time web search and external MCP/LLM services, but it does not clearly warn that token queries and related context may be transmitted to third parties. This is dangerous because users may unknowingly share proprietary trading interests, wallet-related identifiers, or sensitive conversational context with external processors.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation does not clearly warn users that token names and derived prompts are transmitted to third-party search, image-generation, and LLM providers. This creates a transparency and privacy problem because user inputs may be logged, retained, or used by external services without the user's informed consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The integration example maps model output directly to BUY, AVOID, or RESEARCH actions without a prominent warning that the analysis is unreliable and not financial advice. In the context of meme-token speculation, this can encourage unsafe automation or overreliance on probabilistic model output for trading decisions.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code accesses project environment variables and emits `export KEY='value'` lines intended to be consumed by `eval $(python load_env.py)`, which directly injects sensitive values into the current shell session. This is dangerous because secrets may be exposed to users who should not see them, copied into terminal logs or debugging output, and reused outside the intended security boundary.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script uses `eval` on the stdout of `python3 load_env.py`, which means any text emitted by that Python script is executed as shell code in the current shell context. If `load_env.py`, its inputs, or any files/environment it reads can be influenced by an attacker, this becomes arbitrary command execution and is especially dangerous because the script is intended to be sourced to import environment variables.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The command is assembled as a string and executed with eval while incorporating user-influenced values such as mode, node, and especially input. An attacker can break out of the intended quoting and inject arbitrary shell syntax, leading to arbitrary command execution on the host running the skill.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The node sends user-supplied token names and aggregated sentiment text to an external LLM service, but this file shows no consent, minimization, or disclosure controls before transmission. In a skill that analyzes arbitrary tokens and web-derived text, that can expose user inputs and collected data to a third-party processor, creating privacy, compliance, and data-handling risk even if no direct code execution occurs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The /run endpoint logs full request bodies verbatim, which can capture sensitive prompts, credentials, personal data, or proprietary inputs supplied by users. Log exposure turns otherwise transient user data into persistent artifacts that may be accessed by operators, log processors, or attackers who obtain log access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The streaming endpoint also logs complete submitted bodies, creating the same data-exposure risk for potentially long and sensitive user prompts or payloads. Because streaming is often used for interactive or verbose sessions, the volume and sensitivity of logged data may be even greater.

Static analysis

No suspicious patterns detected.