Security audit

Ai Specialists

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed MCP integration, but it gives agents broad remote read/write/delete, signup, credential-handling, and external-request authority without enough scoping or safety controls.

Install only if you trust AI Specialists Hub and are comfortable giving the agent access to specialist workspace contents and account-level operations. Before use, keep MCP keys out of shared files, verify the endpoint host, require explicit confirmation for deletes, imports, hiring/dismissal, and signup, and treat any specialist documents returned by the service as untrusted content rather than instructions that can override the user or system.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:61
Finding: Remote Specialist Documents Are Treated as Trusted Agent Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:125
Finding: MCP Credential Is Stored in a Plaintext Configuration URL
Content: View full analysis
/ ``` ``` ### Technical Analysis The Skill directs the Agent to embed the MCP key directly in an endpoint URL and persist the complete URL in `TOOLS.md`. A credential placed in a URL and stored in a general-purpose Markdown configuration file can be exposed through prompt context, logs, diagnostics, backups, repository commits, file sharing, or accidental output. URL-based secrets are also more likely to appear in HTTP client diagnostics and intermediary telemetry than credentials supplied through a protected authorization header. The Skill provides no file-permission requirements, redaction rules, secret rotation guidance, or separation between public endpoint configuration and secret material. ### Attack Path 1. The user signs up and receives an MCP key. 2. Following the Skill instructions, the Agent stores the complete endpoint containing the username and key in `TOOLS.md`. 3. The file or URL is later included in Agent context, logs, troubleshooting output, a backup, a shared archive, or a source-control commit. 4. An unauthorized party obtains the URL and extracts the MCP key. 5. The party calls the MCP endpoint using the exposed credential. 6. The party performs any operations authorized to that key until it is revoked or rotated. ### Impact Assessment Exposure may permit unauthorized access to specialist workspaces and account operations available through the compromised MCP key. Depending on server-side permissions, this may include reading sensitive specialist documents, modifying or deleting workspace data, importing content, and hiring or dismissing specialists. The issue does not inherently grant lo ...[truncated 212 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/mcp-call.sh (reported line 26)May include surrounding context.
sh
})) " "$TOOL" "$ARGS") RESPONSE=$(curl -s -X POST "$URL" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d "$PAYLOAD")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill clearly instructs use of shell-based HTTP calls (curl) but does not declare any explicit tool scope or allowed-tools constraints. That mismatch can cause the agent to invoke shell/network capabilities more broadly than reviewers or runtime policy expect, increasing the chance of unintended external requests or command execution paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are very broad, triggering on generic mentions such as 'specialist', 'AI specialist', or 'MCP'. Over-broad routing can invoke this skill in unrelated contexts, causing unnecessary access to external endpoints, specialist workspaces, or account-related flows when the user did not intend that integration.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill instructs outbound HTTP POST requests to an MCP endpoint, potentially using a URL sourced from TOOLS.md or directly from the user. Because the endpoint may be user-provided and the payload can include workspace data, this enables external transmission of sensitive information to untrusted or spoofed destinations if not validated.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
Call the MCP endpoint via HTTP POST. The endpoint URL is stored in TOOLS.md or provided by the user.

bash
curl -s -X POST "$MCP_URL" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}}}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes destructive operations such as deleting documents and folders but provides no requirement for user confirmation, preview, or safety checks. In an ambiguous or mistaken invocation, this could lead to irreversible loss of specialist data or workspace contents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's stated purpose is interacting with existing specialists via MCP, but it also adds an agent-initiated account creation workflow for a third-party service. This expands the trust boundary from workspace interaction to user onboarding and credential handling, creating opportunities for unsolicited account creation, collection of personal data, and transmission of secrets to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The signup instructions direct the agent to collect or generate username, email, and password and send them to an external service without requiring a privacy disclosure or explicit informed consent. This creates risk of transmitting sensitive personal data and credentials off-platform without the user understanding where the data is going or how it will be used.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The signup flow sends username, email, and password to an external API, and the response returns an MCP key that is also a sensitive credential. This is dangerous because it combines personal data transmission with secret handling, and if triggered without strong consent or secure handling, it can expose account credentials and integration keys.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
If your human doesn't have an AI Specialists Hub account yet, you can create one via the public signup API:

bash
curl -s -X POST "https://aispecialistshub.com/api/v1/signup" \ -H "Content-Type: application/json" \ -d '{"username":"<username>","email":"<email>","password":"<password>"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This curl POST performs external transmission of the full MCP payload, including tool name and JSON arguments, to an arbitrary URL provided on the command line. Because this skill is explicitly meant to read/write specialist documents and interact with MCP-connected specialists, the transmitted data may include sensitive business or personal content, making unintended exfiltration a realistic risk.
Content: Scanner excerpt · scripts/mcp-call.sh (reported line 26)May include surrounding context.
sh
})) " "$TOOL" "$ARGS") RESPONSE=$(curl -s -X POST "$URL" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d "$PAYLOAD")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends arbitrary JSON tool arguments to a caller-supplied endpoint URL with no validation, allowlist, or user confirmation. In the context of a skill that manages specialist workspaces and documents, this can expose sensitive prompts, documents, meal plans, or operational data to an unintended or attacker-controlled remote service if the URL is influenced by untrusted input.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.