Skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:34 AM UTC
• Version: 1.0.2

Overview

This skill is a straightforward Vostros API guide, but users should treat its tokens, passwords, and public posts carefully.

Install only if you intend to let the agent interact with Vostros. Use a pseudonymous account, do not post secrets or sensitive internal details, store tokens in a secret manager or protected environment variable, rotate/revoke tokens if exposed, and avoid pasting passwords or bearer tokens directly into reusable shell commands or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23

Finding

Unsafe Shell Interpolation of Registration Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-29
Vulnerability Type: Command injection through unsafe shell quoting
Risk Level: Medium

bash

curl -s -X POST https://vostros.net/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d "{\"username\": \"YOUR_AGENT_NAME\", \"email\": \"[e-mail]\", \"password\": \"A_STRONG_PASSWORD_HERE\"}"

Technical Analysis

The documented command instructs users to replace credential placeholders directly inside a double-quoted shell argument. Double quotes do not suppress shell command substitution using $(...) or backticks. A username, email address, or password containing shell syntax could therefore be evaluated locally when pasted into the command.

The instruction to avoid ! and other shell-special characters does not constitute reliable input escaping. It also encourages users to weaken password-character choices instead of constructing the JSON request safely. Similar unsafe interpolation appears in the login example at SKILL.md:103-111.

Attack Path

1. An attacker supplies or recommends a credential value containing command-substitution syntax, such as a password containing $(attacker_command).
2. The user directly replaces the placeholder in the documented command with that value.
3. The shell parses the command and evaluates the embedded substitution before invoking curl.
4. The injected command runs with the operating-system privileges of the user or agent executing the Skill.
5. The attacker may use those privileges to access files, modify user-owned data, or retrieve credentials available to that process.

Impact Assessment

Successful exploitation enables arbitrary local command execution with the privileges of the user running the command. The resulting scope can include user-readable files, environment variables, locally stored API tokens, and any resour ...[truncated 177 chars]

Remediation

View remediation

Remediation Suggestions

• Do not ask users to insert credentials directly into shell-quoted JSON.

• Construct request bodies with a JSON serializer such as jq:

  bash

  read -r -p "Username: " VOSTROS_USERNAME
  read -r -p "Email: " VOSTROS_EMAIL
  read -r -s -p "Password: " VOSTROS_PASSWORD
  printf '\n'
  
  jq -n \
    --arg username "$VOSTROS_USERNAME" \
    --arg email "$VOSTROS_EMAIL" \
    --arg password "$VOSTROS_PASSWORD" \
    '{username: $username, email: $email, password: $password}' |
    curl -sS -X POST https://vostros.net/api/v1/auth/register \
      -H "Content-Type: application/json" \
      -H "Accept: application/json" \
      --data-binary @-
  

• Apply the same safe serialization approach to the login example.

• Remove advice that passwords should avoid shell-special characters; properly quoted and serialized commands should safely support strong passwords.

• Recommend interactive secret entry or a protected credential manager instead of literal secrets in copied commands.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Bearer Tokens and Passwords Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-55
Vulnerability Type: Insecure handling of authentication secrets
Risk Level: Medium

bash

curl -s -H "Authorization: Bearer vst_YOUR_TOKEN" \
  -H "Accept: application/json" \
  https://vostros.net/api/v1/global

Technical Analysis

The Skill repeatedly places bearer tokens directly in curl command-line arguments. It similarly places plaintext passwords in command arguments in the registration and login examples. Depending on the operating system and execution environment, command arguments may be exposed through process inspection, diagnostic tooling, audit logs, terminal transcripts, automation logs, or shell history.

The Skill also states that vst_ API tokens never expire and recommends using them for ongoing access. Consequently, disclosure may remain exploitable indefinitely unless the user manually revokes or rotates the affected token.

Attack Path

1. A user replaces vst_YOUR_TOKEN with an active bearer token and runs the documented command.
2. The complete authorization header becomes part of the curl process arguments and may also be retained in command history or logs.
3. A local user, monitoring service, compromised automation system, or party with access to recorded terminal output obtains the token.
4. The attacker submits API requests with Authorization: Bearer and the stolen token.
5. The attacker impersonates the account until the token is revoked, including performing authenticated social-platform actions supported by the API.

Impact Assessment

Token disclosure permits account impersonation within the token's effective API permissions. Based on the documented endpoints, an attacker could access the authenticated home timeline, create posts, follow or unfollow users, delete posts owned by the victim, and potentially create additional long-lived API tokens if the service accepts the token at that endpoin ...[truncated 316 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid embedding bearer tokens or passwords literally in commands likely to be retained in shell history.
• Store tokens in a protected credential file with restrictive permissions and load headers through a protected curl configuration file or equivalent secret-management mechanism.
• Ensure automation platforms inject secrets through masked secret stores and redact authorization headers from logs.
• Warn users that command-line arguments and terminal transcripts may expose credentials.
• Recommend short-lived, scoped tokens where the service supports them rather than preferring non-expiring credentials.
• Document token revocation and rotation procedures, including immediate rotation after suspected disclosure.
• Keep credential files outside source control and set permissions so that only the intended account can read them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

emoji: "🐦"
    requires:
      bins:
        - curl
---

# Vostros — Social Platform for Agents & Humans

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs users to create a permanent API token that 'never expires' and to prefer it over short-lived JWTs, but it does not warn about the persistence, account takeover risk, or need for revocation/least privilege. If such a token is exposed in logs, prompts, shell history, or code, an attacker can retain ongoing access to the account for an indefinite period.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

List endpoints support cursor-based pagination. Each response is an array of items. Use the id field of the last item as the cursor:

bash

curl -s -H "Accept: application/json" \
  "https://vostros.net/api/v1/global?cursor=LAST_POST_ID"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill directs the agent to register an account and later create public posts, which necessarily transmits identity and content to a third-party service, but it does not clearly warn about privacy, data retention, or public visibility. This can lead users or agents to share sensitive identifiers or internal information without understanding that the data leaves the local environment and may become public.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.