Security audit

Kitful SEO Article Writer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward Kitful.ai article-generation integration, with some credential-handling and data-sharing cautions users should understand before use.

Install only if you are comfortable sending article prompts, context, brand URLs, and workspace identifiers to Kitful.ai. Keep the API key private, prefer environment-variable based commands for exports, and avoid putting secrets, private client details, or unpublished business information into prompts unless you intend Kitful to process them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:163
Finding: API Credential Disclosure Through a User-Visible Export Command
Content: View full analysis
` ``` ### Technical Analysis The Skill instructs the agent to substitute the user's Kitful API key directly into a command presented in the conversation. Although the documented command initially uses the placeholder `kit_your_key`, the preceding instruction explicitly directs replacement with the real credential. Embedding a resolved secret in agent output violates secure credential-handling practices. The API key can persist in conversation transcripts, telemetry, copied messages, screenshots, support records, or other systems that store model output. If the user executes the interpolated command, the credential may also be retained in shell history and potentially exposed through process-command-line inspection while the command is running. The external Kitful API access itself is aligned with the Skill's stated article-generation purpose. The vulnerability is specifically the unnecessary disclosure of the bearer credential in user-visible output. ### Attack Path 1. The user configures a valid `KITFUL_API_KEY` for the Skill. 2. The user requests and successfully generates an article. 3. Upon completion, the Skill instructs the agent to produce an export command containing the substituted API key. 4. The response containing the bearer credential is retained in chat history or associated logs. 5. Alternatively, the user executes the command and leaves the credential in shell history or observable process arguments. 6. A party with access to one of these record ...[truncated 673 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill sends user-supplied topics, context, optional workspace slug, and optional brand URL to the external Kitful API, but the user-facing description does not clearly disclose that their prompts and related metadata leave the local environment. This can cause inadvertent sharing of sensitive business, personal, or client information with a third party, especially because the skill invites users to include product, agency, and workspace details in prompts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions specify Default: en, which forces English whenever the user does not explicitly request another language. Under the language/locale policy, a skill should not impose a specific language by default unless the user is given a choice or the constraint is clearly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.