T06 · System Persistence
Error
- Location
cron-setup.md:20- Finding
Persistent Autonomous Agent Jobs Can Publish Content Without Per-Run Approval
- Content
View full analysis
- Remediation
View remediation
Security audit
Genviral - Social Media Automation
Security checks for vulnerabilities and agentic risk
Overview
This skill is legitimate social-media automation, but it needs review because it can publish or delete live content, set up recurring autonomous posting, and uses risky credential/config loading.
Install only if you are comfortable giving the skill authority over connected social accounts. Start with test accounts or draft/self-only modes, avoid enabling the cron jobs until you add explicit approval before posting, protect and rotate GENVIRAL_API_KEY if exposed, do not store secrets in shared or committed env files, keep the API base URL pinned to Genviral, and manually confirm any delete or bulk-delete operation.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/genviral.sh:176- Finding
Automatic Sourcing of a Global Environment File Enables Arbitrary Shell Execution
- Content
View full analysis
/dev/null || true API_KEY="${GENVIRAL_API_KEY:-}" BASE_URL="$(config_get base_url "https://www.genviral.io/api/partner/v1")" DEFAULT_PACK_ID="$(config_get default_pack_id "")" DEFAULT_SLIDE_COUNT="$(config_get default_slide_count "5")" DEFAULT_ASPECT_RATIO="$(config_get default_aspect_ratio "4:5")" DEFAULT_TYPE="$(config_get default_type "educational")" DEFAULT_STYLE="$(config_get default_style_preset "tiktok")" DEFAULT_LANGUAGE="$(config_get language "en")" DEFAULT_ACCOUNT_IDS="$(config_get default_account_ids "")" DEFAULT_PRIVACY="$(config_get privacy_level "PUBLIC_TO_EVERYONE")" DEFAULT_POST_MODE="$(config_get post_mode "DIRECT_POST")" HTTP_CONNECT_TIMEOUT="$(config_get connect_timeout "10")" HTTP_MAX_TIME="$(config_get max_time "120")" HTTP_RETRIES="$(config_get retries "2")" HTTP_RETRY_DELAY="$(config_get retry_delay "2")" } ``` The function executes before command dispatch: ```bash check_deps load_defaults COMMAND="${1:-help}" shift 2>/dev/null || true ``` ### Technical Analysis Bash `source` does not treat the target as a data-only environment file. It executes every shell construct in that file in the current process. Consequently, aliases, functions, command substitutions, redirections, external commands, and arbitrary shell statements placed in `~/.config/env/global.env` execute with the privileges of the user invoking the wrapper. The global file is loaded before command selection, authentication checks, and API operations. Therefore, the behavior is triggered even for apparent ...[truncated 1443 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/genviral.sh:218- Finding
Unvalidated Configurable API Endpoint Can Receive the Genviral Bearer Token
- Content
View full analysis
&1)" || { die "Request failed: curl error for $method $endpoint" } ``` ### Technical Analysis The wrapper treats `base_url` as trusted configuration even though the configuration file can be selected through `GENVIRAL_CONFIG`. It does not enforce HTTPS, verify that the hostname is an approved Genviral domain, or otherwise bind the bearer token to its intended origin. As a result, anyone who can influence the process environment or selected configuration file can redirect authenticated requests to another host. The `Authorization: Bearer` header is then transmitted to that host. The default checked-in value is the legitimate endpoint: ```yaml base_url: "https://www.genviral.io/api/partner/v1" ``` Therefore, exploitation re ...[truncated 1318 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (25)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md 1. **Hook Selection:** Read `hooks/library.json` and pick a hook. Rotate through categories. 2. **Prompt Assembly:** Use the selected hook to build a full slideshow prompt. Reference `prompts/slideshow.md`. 3. **Generate Slideshow:** Run `generate` with the assembled prompt.
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md # Slideshow Prompt Templates Use these templates when generating slideshows via the genviral API. Before using any template:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh analytics-target-create POST /analytics/targets analytics-target GET /analytics/targets/{id} analytics-target-update PATCH /analytics/targets/{id} analytics-target-delete DELETE /analytics/targets/{id} analytics-target-refresh POST /analytics/targets/{id}/refresh analytics-refresh | get-analytics-refresh GET /analytics/refreshes/{id}
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh require_arg "id" "$pack_id" warn "Deleting pack $pack_id..." api_call DELETE "/packs/${pack_id}" >/dev/null ok "Pack deleted." }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh warn "Deleting image $image_id from pack $pack_id..." api_call DELETE "/packs/${pack_id}/images/${image_id}" >/dev/null ok "Image deleted from pack." }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh require_arg "id" "$template_id" warn "Deleting template $template_id..." api_call DELETE "/templates/${template_id}" >/dev/null ok "Template deleted." }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh require_arg "id" "$slideshow_id" warn "Deleting slideshow $slideshow_id..." api_call DELETE "/slideshows/${slideshow_id}" >/dev/null ok "Slideshow deleted." }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh warn "Deleting analytics target $id..." local response response="$(api_call DELETE "/analytics/targets/${id}")" ok "Analytics target deleted" printf '%s' "$response" | jq '.data'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The quick-start examples include render and create-post commands that can immediately publish media to connected accounts, but they are presented like routine setup steps without an explicit live-posting warning. Because this skill's purpose is cross-platform publishing, a user or downstream agent could run these commands assuming they are harmless examples, leading to unintended public posts on TikTok, Instagram, or other linked platforms.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly promotes unattended cron-based automation of the full pipeline, including generate, render, review, and post, but does not clearly warn that this can publish content to real connected social accounts without human approval. In a skill designed to operate across multiple platforms, this omission materially increases the chance of accidental mass posting, brand damage, policy violations, or abuse if the skill is misconfigured or invoked in the wrong environment.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill exposes extensive shell-based capabilities through a bash wrapper but does not declare any tool scope or permissions boundary. This increases the chance an agent invokes networked or state-changing commands without explicit policy gating, especially because the skill includes upload, posting, deletion, and analytics actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description claims support for posting to 'any supported platform,' which is overly broad and can cause an agent to over-trust the skill's applicability or perform actions against unintended account types. In a posting automation skill, ambiguous scope increases operational risk because agents may assume capabilities or compatibility that have not been clearly bounded.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents immediate publishing, scheduling, retry, and deletion workflows without a strong up-front warning that these are live, externally visible, and potentially destructive actions. In an automation context, an agent could publish content or delete posts with insufficient user awareness or confirmation, causing reputational or operational harm.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The upload section explains how to transfer local files to Genviral's CDN but does not clearly warn that selected files leave the local environment and are transmitted to third-party infrastructure. This creates privacy and data handling risk if an agent uploads sensitive, proprietary, or personal media without the user understanding the destination and retention implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This is a real safety issue because the file provides ready-to-run cron jobs that will autonomously generate content, post to external social media accounts, and modify local tracking files without an explicit warning about unattended actions. In this skill's context, the risk is heightened because the scheduled prompts instruct the agent to make publishing and file-update decisions automatically, which can lead to unauthorized posts, brand damage, or persistent bad state in local data if the workflow misfires.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The configuration hard-codes
language: "en", which imposes a specific language choice without indicating user selection, opt-in, or justification. This is a natural-language policy concern because it can override user locale expectations without offering a choice.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script sources ${HOME}/.config/env/global.env during startup, which executes arbitrary shell content from the local host rather than merely reading configuration. In an agent skill context, this expands scope from Partner API automation into host-side secret access and code execution via a user-controlled file, increasing the blast radius well beyond the advertised functionality.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script performs irreversible deletion of a pack immediately after printing a warning message, but does not require user confirmation or an explicit force flag. Under the code-file criteria, destructive operations should include some user disclosure safeguard; a warning-only log is weaker than an interactive confirmation for irreversible deletes, especially in a broad automation wrapper.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This command deletes a pack image immediately after logging a warning, with no prompt or opt-in flag to confirm the irreversible action. Because the operation modifies remote user data, the current disclosure is minimal and does not ensure the user intended the deletion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The delete-template command performs an irreversible remote deletion with only a warning log before execution. For destructive operations in code files, a clearer user-facing safeguard such as confirmation or an explicit force option is appropriate to prevent accidental data loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The command deletes a slideshow after emitting a warning, but there is no confirmation step before the irreversible API call. Since this removes user content remotely, accidental invocation could lead to unwanted data loss without sufficient runtime disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This bulk deletion command can remove up to 50 posts but only emits a warning before submitting the delete request. The lack of confirmation or a force-style acknowledgment is a missing user warning for a high-impact destructive operation affecting multiple remote resources.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The command deletes an analytics target after a warning log but offers no confirmation prompt or explicit user acknowledgment. For irreversible remote deletions, this is insufficient protection against accidental command execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The setup guide instructs users to persist an API key in an environment file without warning that the value contains a secret credential that must be protected from source control, shared machines, backups, and logs. In a skill that automates posting and account management across social platforms, exposure of this key could let an attacker create, modify, or schedule content and access connected account data through the Genviral API.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This manifest config enables posting every day of the week at a configured time, but it does not document any limiting conditions, exclusion cases, or narrower activation context for when automated posting should or should not occur. For manifest files, missing specificity on trigger scope or constraints can lead to unintended skill invocation or execution patterns.
- Content