T09 · Insecure Skill Coding Practices
Error
- Location
README.md:32- Finding
API Credentials May Be Sent to a Fixed Third-Party Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Miniflux Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Miniflux management helper, but its README can direct users to send their API token to a fixed third-party Miniflux URL and its destructive commands lack confirmation safeguards.
Review this skill before installing. Use only a MINIFLUX_URL for the Miniflux instance you control or explicitly trust, never send a real API token to the README's fixed reader.etereo.cloud example unless that is your intended server, and rotate any token already used against the wrong host. Treat delete and bulk mark-read commands as account-changing operations that should be explicitly confirmed. Prefer installing the Python dependency in an isolated, pinned environment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
README.md:16- Finding
Unpinned Dependency Is Installed into Broad Python Environments
- Content
View full analysis
/dev/null; then echo "Error: miniflux Python package not installed." echo "Please install it manually:" echo " uv pip install miniflux" echo "" echo "Or with pip:" echo " pip install miniflux" exit 1 fi ``` ### Technical Analysis The installation commands request the package by name without a pinned version or cryptographic hash. The effective dependency can therefore change after the Skill has been reviewed. A later compromised, malicious, or incompatible package release would be installed without further source review. The README compounds the exposure by recommending `--system` and `--break-system-packages`. These options install into broad Python environments or bypass operating-system package-management protections rather than isolating the dependency in a dedicated virtual environment. Python packages may execute code during installation, and imported package code executes in the context of the invoking user. This Skill imports `miniflux` at startup, so a compromised installed package would also execute whenever the CLI runs. ### Attack Path 1. An attacker compromises the upstream package, package maintainer account, publication pipeline, or package-index delivery path. 2. A malicious release becomes the version resolved by the unpinned installation command. 3. A user follows the ...[truncated 1079 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/miniflux-cli.py:145- Finding
Attacker-Controlled Feed Content Is Emitted Without a Trust Boundary
- Content
View full analysis
]+>', '', entry['content']) content = re.sub(r'\s+', ' ', content).strip() if len(content) > 500: content = content[:500] + "..." output += f"\n Content: {content}" output += f"\n ID: {entry.get('id')}" return output ``` `scripts/miniflux-cli.py:145-157`: ```python def cmd_entry(args): """Get a specific entry.""" client = get_client() entry = client.get_entry(args.entry_id) print(format_entry(entry, full_content=True)) if entry.get('content'): print(f"\n📝 Full Content:\n{entry['content']}") return 0 ``` `scripts/miniflux-cli.py:386-398`: ```python entries_parser.add_argument('--status', choices=['unread' ...[truncated 3299 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README documents destructive operations such as deleting feeds and categories and marking items as read, but it does not warn users that these actions modify server-side state and may be irreversible or hard to recover. In a skill designed to be invoked by an agent or copied by users, omission of cautions increases the risk of accidental data loss or unintended bulk changes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents capabilities that require environment access and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may invoke broader-than-expected capabilities, increasing the chance of secret exposure from MINIFLUX_TOKEN or unintended API actions against the Miniflux instance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises destructive operations such as deleting feeds and categories and marking items as read, but it provides no warning, confirmation guidance, or safety notes about irreversible or state-changing effects. In an agent setting, this raises the risk of accidental data loss or unwanted account changes if a user request is ambiguous or the agent acts too aggressively.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The delete-feed command performs an irreversible state-changing action immediately with no confirmation prompt, dry-run mode, or force flag. In an agent or CLI context, this increases the chance of accidental deletion from user error, prompt misinterpretation, or unsafe automation, causing loss of subscriptions and associated configuration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The mark-feed-read command bulk-modifies all unread entries in a feed without warning or confirmation. Because this action can silently alter large amounts of user state, an accidental or manipulated invocation can cause users to lose track of unread content and undermine trust in automation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The delete-category command deletes a category immediately without a confirmation barrier. In a management skill that exposes destructive administrative actions, lack of confirmation makes accidental data loss more likely, especially when invoked by higher-level agents that may misunderstand user intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L91 states that all documentation must be in English, which is a language policy constraint expressed in natural language. Under the policy rules, forcing a specific language without opt-in or clear regional/compliance justification is a reportable violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill instructs users to export an API token into the environment but does not include any warning about secret handling, logging, shell history, or avoiding token disclosure. While this is common setup guidance, omission of basic token-safety instructions can lead to credential leakage in shared terminals, transcripts, or debugging output.
- Content
Static analysis
No suspicious patterns detected.