Security audit

Ryot

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises for Ryot media tracking, with clear but important credential and scheduled-notification risks users should understand.

Install only if you are comfortable giving the skill a Ryot API token. Use a trusted HTTPS Ryot URL, protect /home/node/clawd/config/ryot.json with private permissions, and review the optional cron/WhatsApp jobs before enabling them because they will continue sending report output until removed. Commands such as complete, review, collection create/add, and bulk episode marking change your Ryot account data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ryot_api.py:21
Finding: Bearer Token May Be Transmitted to an Untrusted or Unencrypted Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: Plaintext API Token Storage Is Documented Without Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This mismatch includes materially different behavior: creating scheduled automations and configuring WhatsApp delivery, which introduces persistent outbound messaging beyond ordinary media tracking. Hidden or under-disclosed automation and third-party notification channels increase the risk of unanticipated data sharing, spam, and ongoing actions after initial setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch includes materially different behavior: creating scheduled automations and configuring WhatsApp delivery, which introduces persistent outbound messaging beyond ordinary media tracking. Hidden or under-disclosed automation and third-party notification channels increase the risk of unanticipated data sharing, spam, and ongoing actions after initial setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This mismatch includes materially different behavior: creating scheduled automations and configuring WhatsApp delivery, which introduces persistent outbound messaging beyond ordinary media tracking. Hidden or under-disclosed automation and third-party notification channels increase the risk of unanticipated data sharing, spam, and ongoing actions after initial setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch includes materially different behavior: creating scheduled automations and configuring WhatsApp delivery, which introduces persistent outbound messaging beyond ordinary media tracking. Hidden or under-disclosed automation and third-party notification channels increase the risk of unanticipated data sharing, spam, and ongoing actions after initial setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch includes materially different behavior: creating scheduled automations and configuring WhatsApp delivery, which introduces persistent outbound messaging beyond ordinary media tracking. Hidden or under-disclosed automation and third-party notification channels increase the risk of unanticipated data sharing, spam, and ongoing actions after initial setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch includes materially different behavior: creating scheduled automations and configuring WhatsApp delivery, which introduces persistent outbound messaging beyond ordinary media tracking. Hidden or under-disclosed automation and third-party notification channels increase the risk of unanticipated data sharing, spam, and ongoing actions after initial setup.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch includes materially different behavior: creating scheduled automations and configuring WhatsApp delivery, which introduces persistent outbound messaging beyond ordinary media tracking. Hidden or under-disclosed automation and third-party notification channels increase the risk of unanticipated data sharing, spam, and ongoing actions after initial setup.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documentation explicitly directs use of Python scripts against a remote GraphQL API and references reading a local config file with credentials, but the manifest declares no tool scope or allowed-tools. This creates a transparency and containment problem: an agent may perform authenticated network actions and local file access without the permission boundary being clearly declared to users or the platform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The automated setup enables recurring reports and WhatsApp delivery without prominently warning that the skill will continue sending outbound notifications and sharing data on a schedule. In context, persistence and external delivery make this more dangerous because a one-time setup can create long-lived data flows the user may not fully understand or remember.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Adding WhatsApp delivery expands the skill's data exposure to an external messaging platform not central to the stated Ryot tracking function. Without clear justification and consent, users may unknowingly route media activity, schedules, or account-linked information to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell the agent to solicit and store a user's API token in a local file without any warning about credential sensitivity, storage risks, or least-privilege handling. In an agent context, this is dangerous because it normalizes collecting secrets through conversational flow and persisting them on disk, increasing the chance of leakage or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code loads an API token from local configuration and sends it in an HTTP Authorization header to a remote GraphQL endpoint. While the script's purpose is to fetch calendar data, there is no visible warning, log message, or explanatory comment disclosing that it reads credentials and transmits data over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code accesses sensitive credentials via the config file and transmits them as a bearer token in an HTTP request. Although the behavior is functional, there is no visible warning, prompt, or explanatory comment/docstring informing the user that credentials will be used for authenticated network calls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The create_collection function performs a remote state-changing GraphQL mutation using stored credentials with no confirmation, dry-run mode, or explicit user disclosure at the point of action. In an agent-skill context, this can cause silent modification of a user's remote account data, which is more dangerous because users may invoke higher-level automation without realizing it will create persistent server-side objects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The add_to_collection function issues a remote mutation that alters user data by adding media metadata to a collection, again without confirmation or clear warning. In the context of an agent skill that may be invoked programmatically, undisclosed write actions increase the risk of unintended bulk or repeated modifications to a user's account and can be abused if the skill is triggered deceptively.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code performs an authenticated HTTP POST to a remote GraphQL endpoint, transmitting metadata identifiers, ratings, and optional review text. While the script prints a success message after completion, it does not provide any prior user-facing disclosure in code comments, docstrings, or prompts that local input will be sent to a server.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script loads an API token from local configuration and sends it in an Authorization header during GraphQL requests. While this behavior is functionally expected for the integration, the file contains no confirmation prompt and no user-facing warning or explanatory comment/docstring disclosing that credentials and usage data are sent over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The string literal instructs the system to respond in Italian ('Esegui lo script ... e inviami l'output...'), which imposes a specific language on generated output. The script does not offer any language selection or document a region-specific reason for this constraint, making it a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The publishing guide instructs users to store an API token in /home/node/clawd/config/ryot.json in plaintext without any warning about file permissions, secret handling, or safer storage options. This can lead to accidental disclosure through backups, logs, shared systems, or overly permissive filesystem access, especially on multi-user hosts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The manifest says the skill requires an existing config file containing the Ryot URL and API token, but the operational note directs the agent to ask for credentials and create /home/node/clawd/config/ryot.json if it does not exist. Creating and persisting credentials on disk is a separate capability beyond the core media-tracking purpose described in the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.