HiEnergy Advertiser Intelligence Affiliate Copilot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:52 PM UTC
• Version: 2.2.1

Overview

This HiEnergy skill is mostly coherent and disclosed, but it can change account data and reveal contacts or transactions without enough built-in confirmation or redaction.

Review this skill before installing if your HiEnergy key can modify contacts or publisher records. Use a least-privilege API key if available, avoid passing keys on the command line, avoid running debug scripts in logged environments, and require human confirmation before any contact creation, reassignment, or publisher update.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hienergy_skill.py:1651
• Finding: API Key Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hienergy_skill.py:1651-1658` **Vulnerability Type**: Command-line credential exposure **Risk Level**: Medium ### Vulnerable Code ```python # Check if API key is provided if len(sys.argv) > 1: api_key = sys.argv[1] else: api_key = os.environ.get('HIENERGY_API_KEY') if not api_key: print("Usage: python hienergy_skill.py <api_key>") print("Or set HIENERGY_API_KEY environment variable") ``` ### Technical Analysis The script accepts the HiEnergy API key as a positional command-line argument and explicitly recommends this invocation through its usage message. Command-line arguments are not an appropriate channel for secrets because they may be exposed through: - Shell command history. - Process inspection utilities and operating-system process metadata. - Process accounting and endpoint-monitoring products. - CI/CD command logs. - Terminal session recording and diagnostic collection. Although the script also supports an environment variable, the positional argument takes precedence and the displayed usage encourages users to expose the credential. ### Attack Path 1. A user follows the displayed instruction and runs: ```bash python scripts/hienergy_skill.py <real-api-key> ``` 2. The command, including the key, is retained in shell history or process-monitoring data. 3. Another local user, administrator, monitoring agent, support operator, or log reader obtains the argument. 4. The exposed key is replayed against `https://app.hienergy.ai/api/v1`. 5. The attacker receives the same API permissions and data access assigned to the compromised HiEnergy account. This path requires access to local process information, history, or collected logs; it does not provide remote code execution by itself. ### Impact Assessment A recovered key can authorize access to the account-scoped HiEnergy API. Depending on the compromised account's server-side privileges, this can expose adverti ...[truncated 347 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove positional command-line support for the API key. 2. Require `HIENERGY_API_KEY` or the documented alias from a protected environment or secret manager. 3. Replace the usage message with: ```python api_key = ( os.environ.get("HIENERGY_API_KEY") or os.environ.get("HI_ENERGY_API_KEY") ) if not api_key: print("Set HIENERGY_API_KEY in a protected environment.") sys.exit(1) ``` 4. If interactive entry is necessary, use `getpass.getpass()` so the key is not echoed or stored in command history. 5. Document secure secret injection for CI/CD systems. 6. Rotate any key that has previously been supplied on a command line. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: debug_api_connectivity.py:20
• Finding: Authenticated API Response Headers and Bodies Printed Without Redaction<![CDATA[ ## Vulnerability Details **File Location**: `debug_api_connectivity.py:20-24` **Vulnerability Type**: Sensitive data exposure through diagnostic output **Risk Level**: Low ### Vulnerable Code ```python response = requests.get(url, headers=headers, params={'limit': 1}, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response Headers: {response.headers}") print(f"Response Body: {response.text}") ``` ### Technical Analysis The diagnostic script performs an authenticated request and prints the complete response headers and body. These values are emitted without field-level filtering, length limits, or a deliberate opt-in for sensitive debug output. The response body can contain account-scoped advertiser information. Response headers may contain request identifiers, infrastructure details, cookies, rate-limit metadata, or other operational data. Terminal output is frequently retained by CI systems, remote support sessions, shell capture tools, and centralized logging agents. The request-side `X-Api-Key` header is not directly printed by this code. The exposure concerns authenticated response content and any sensitive response headers returned by the service. ### Attack Path 1. A user runs `debug_api_connectivity.py` with a valid API key. 2. The HiEnergy service returns authenticated account data or sensitive diagnostic headers. 3. The script prints the complete response to standard output. 4. A CI service, terminal recorder, support bundle, or centralized logger stores that output. 5. A person with access to those records reads information that was intended only for the authenticated account. Exploitation requires access to the generated terminal or log output. ### Impact Assessment The exposed scope depends on the API response. In the current script, the request is limited to one advertiser result, reducing volume but not eliminating confidentiality risk. Potential exposure includes advertiser data, internal identifiers, ser ...[truncated 162 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Print only the status code and a sanitized request identifier by default. 2. Do not print complete authenticated response bodies or header mappings. 3. Maintain an explicit allowlist for safe response headers, such as a non-sensitive correlation ID. 4. Put verbose response output behind an explicit local-only flag. 5. Redact cookies, authorization-related fields, email addresses, phone numbers, account identifiers, and other personal or business-sensitive data. 6. Ensure CI and production environments never enable verbose diagnostics. 7. Apply restrictive access and retention controls to existing diagnostic logs. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/hienergy_skill.py:112
• Finding: Remote API Error Bodies Propagated Into Exceptions Without Sanitization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hienergy_skill.py:112-121` **Vulnerability Type**: Sensitive information disclosure through exception messages **Risk Level**: Low ### Vulnerable Code ```python except requests.exceptions.HTTPError as e: status = e.response.status_code if e.response is not None else 'unknown' body_preview = '' if e.response is not None: body_preview = (e.response.text or '')[:300] if status == 429: retry_after = None if e.response is not None: retry_after = e.response.headers.get('Retry-After') hint = f" Please retry in {retry_after} seconds." if retry_after else " Please retry in a few seconds." raise HiEnergySkillError(f"Rate limited by HiEnergy API (HTTP 429).{hint}") raise HiEnergySkillError(f"API request failed (HTTP {status}): {body_preview}") ``` ### Technical Analysis For non-rate-limit HTTP failures, the client copies up to 300 characters of the remote response body into an exception. Callers commonly print these exceptions, and several project scripts do so. Remote error bodies can contain validation data, submitted values, object identifiers, internal diagnostic messages, or account-scoped information. Copying them into a general exception crosses a trust and confidentiality boundary because the resulting message may be shown in agent output, CI logs, chat transcripts, or monitoring systems. The 300-character limit constrains volume but does not sanitize sensitive fields. ### Attack Path 1. An authenticated request causes a non-2xx response, such as a validation or authorization error. 2. The service includes sensitive request-related or diagnostic information in the response body. 3. `_make_request` copies the first 300 characters into `HiEnergySkillError`. 4. A caller prints or records the exception. 5. An unintended log or transcript reader obtains the disclosed information. Where a user can influence submitted values, th ...[truncated 522 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace raw response content with a generic error message: ```python request_id = e.response.headers.get("X-Request-ID") if e.response is not None else None suffix = f" Request ID: {request_id}" if request_id else "" raise HiEnergySkillError(f"API request failed (HTTP {status}).{suffix}") ``` 2. Preserve detailed bodies only in a restricted, opt-in diagnostic channel. 3. Redact known sensitive fields before any debug logging. 4. Use structured logging with confidentiality classifications and access controls. 5. Add tests confirming that API keys, email addresses, phone numbers, cookies, and raw response bodies do not appear in raised exception strings. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Third-Party Dependency Is Not Reproducibly Pinned<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1` **Vulnerability Type**: Non-reproducible dependency resolution **Risk Level**: Low ### Vulnerable Code ```text requests>=2.31.0,<3.0.0 ``` The documented installation command in `SKILL.md:30-35` is: ```bash export HIENERGY_API_KEY="<your_api_key>" # optional alias export HI_ENERGY_API_KEY="$HIENERGY_API_KEY" pip install -r requirements.txt ``` ### Technical Analysis The dependency range permits any future `requests` 2.x release rather than selecting a specific reviewed artifact. No package hashes or lock file are supplied. Consequently, identical installation commands at different times or against differently configured Python indexes can install different package code and transitive dependency versions. The project uses the legitimate package name `requests`; no typosquatting or known malicious package was identified. The confirmed weakness is the absence of reproducible pinning and integrity verification, which increases supply-chain exposure. ### Attack Path 1. A user runs `pip install -r requirements.txt`. 2. The package resolver queries the user's configured package indexes. 3. It selects the newest version satisfying `>=2.31.0,<3.0.0`, along with currently resolved transitive dependencies. 4. If a future release, compromised index, or substituted artifact is malicious or vulnerable, unreviewed package code is installed. 5. That code can execute during installation or later when imported by the skill. Successful exploitation requires compromise or unsafe configuration of the dependency distribution channel, or publication of a harmful version satisfying the range. ### Impact Assessment A malicious installed dependency would run with the privileges of the user installing or executing the skill. It could read the `HIENERGY_API_KEY`, access files available to that user, modify local data, or make arbitrary network requests. No malicious dependency is present in the audite ...[truncated 114 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate a reviewed lock file with exact versions for direct and transitive dependencies. 2. Include cryptographic hashes and install with: ```bash pip install --require-hashes -r requirements.lock ``` 3. Retain `requirements.txt` as an input specification only if a deterministic lock-generation workflow is used. 4. Configure CI to install exclusively from trusted indexes over TLS. 5. Run dependency vulnerability and provenance checks during releases. 6. Review and deliberately update the lock file rather than accepting future versions automatically. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (22)

Tainted flow: 'headers' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

"Content-Type": "application/json"
    }
    print(f"Requesting {url}...")
    response = requests.get(url, headers=headers, params={'limit': 1}, timeout=10)
    
    print(f"Status Code: {response.status_code}")
    print(f"Response Headers: {response.headers}")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 6, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

print(f"Requesting {url} with params {params}...")
try:
    response = requests.get(url, headers=headers, params=params, timeout=30)
    print(f"Status: {response.status_code}")
    print(f"Data length: {len(response.text)}")
except Exception as e:

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill description emphasizes discovery and querying, but it also exposes mutation operations like create_contact, replace_contact, and update_publisher. Users or orchestrators may treat the skill as read-only based on the description, creating a risk of unintended data modification in a third-party account.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description emphasizes discovery and querying, but it also exposes mutation operations like create_contact, replace_contact, and update_publisher. Users or orchestrators may treat the skill as read-only based on the description, creating a risk of unintended data modification in a third-party account.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The skill includes mutating operations that create contacts, replace contacts, and update publishers, while its natural-language copilot framing emphasizes discovery and intelligence lookups. In an agent setting, exposing write-capable methods without strong authorization, confirmation, and scope separation increases the risk of unintended or unauthorized remote state changes to CRM-like records.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The publisher update capability allows arbitrary PATCH updates to publisher attributes, and the intent classifier even associates publisher queries with 'network key' and 'credential' concepts. In a broadly exposed skill, this creates a dangerous path for modifying sensitive publisher configuration or credential-related fields unrelated to simple affiliate intelligence lookup.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises access to environment credentials and networked API operations but does not declare tool scope such as allowed tools or permissions. That weakens least-privilege controls and makes it harder for a host platform or reviewer to understand and constrain what the skill can access at runtime.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This script retrieves partner contact information, including names and email addresses, and prints it directly to stdout without any access-control check, masking, consent notice, or sensitivity warning. In many agent/runtime contexts, console output is logged, persisted, or shown to downstream users, which can expose personal contact data beyond the intended audience and create privacy/compliance risk.

Description-Behavior Mismatch

Medium

• Confidence: 79% confidence
• Finding: The manifest description is heavily framed around finding, querying, and managing affiliate programs, deals, transactions, advertiser intelligence, and partner contacts through API lookups and analytics. This script performs a privileged write operation to create a new contact, which is materially different from the mostly discovery/query-oriented capability described and introduces account-modifying behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script retrieves affiliate transaction records and prints publisher-identifying data and transaction details directly to stdout, which can expose sensitive business and partner information in terminals, logs, CI output, or shared execution environments. In this skill’s affiliate-marketing context, transaction amounts, dates, statuses, and publisher names are commercially sensitive and may also constitute personal or partner data depending on the publisher representation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script prints transaction details to stdout and, when no match is found, dumps a full sample transaction record for debugging. Transaction objects in affiliate/advertiser systems commonly contain sensitive business data and may include partner identifiers, financial amounts, contact metadata, or other fields that should not be exposed in logs or console output, especially in shared runtime environments.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This code file makes network-backed data retrieval calls via `get_advertisers` and `get_transactions`, then outputs transaction metadata including dates, amounts, status, and publisher names. While it logs progress, those messages do not warn the user that potentially sensitive transactional data will be accessed and displayed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: create_contact sends user-supplied contact data to the remote API immediately, with no in-method confirmation, dry-run, or safety prompt. In an agent environment, this can cause accidental disclosure of personal data and unintended creation of records if a user request is ambiguous or the agent overreaches.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring describes a concrete multi-step intent involving web search for LinkedIn contacts and then creating contacts in the API, but the function body simply returns None. This is not merely incomplete documentation; it actively describes behavior that is absent from the code and could mislead reviewers about the skill's implemented capabilities.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: replace_contact reassigns a contact to another advertiser via a POST request without confirmation or secondary verification. A mistaken invocation could corrupt partner relationship data or move sensitive contact records to the wrong account.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: update_publisher performs direct remote modifications using arbitrary caller-provided data and does not require confirmation or constrain which fields may be changed. This makes accidental destructive edits or unauthorized configuration changes more likely when used through natural-language automation.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The intent router maps broad terms like 'contact', 'lead', 'client', and 'prospect' directly to contact lookup, then returns contact results in chat. This weak intent boundary can cause personal-contact disclosure from vague prompts that do not establish authorization or the user's need to access PII.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The contact formatting function explicitly prints email addresses into chat responses. Exposing direct contact details in conversational output increases the risk of unnecessary personal-data disclosure, prompt-triggered harvesting, and leakage into logs or transcripts.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The general search path queries contacts alongside other resources and returns matched names, enabling broad natural-language prompts to surface contact information without a dedicated privacy gate. Because contacts are included in a catch-all search flow, users may receive personal data even when they did not clearly request contact disclosure.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The script reads an API key from the environment and uses it to initialize an external service client, but there is no comment, docstring, or user-facing disclosure that the skill accesses credentials for outbound use. The existing print only appears when the key is absent, so it does not warn users about the credential-dependent behavior during normal execution.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: This code fetches recent transactions via `skill.get_transactions(...)`, which is a network/data-access operation involving potentially sensitive account information. While errors are printed, there is no user-facing warning, confirmation, or explanatory comment/docstring disclosing that the script will access remote transaction data.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The dependency is only constrained to a broad range (`>=2.31.0,<3.0.0`) rather than pinned to a specific patched release, so builds may resolve to different `requests` versions over time, including versions affected by known advisories. In a skill that calls external APIs and may handle authentication, using a potentially vulnerable HTTP client increases the chance of credential leakage, TLS/verification issues, or other request-handling flaws if an unsafe version is installed.

Static analysis

No suspicious patterns detected.