Security audit

digest-comunidad-f100k

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent social-media digest purpose, but it handles connected account data and private comment identifiers with conflicting delivery instructions and weak user-control boundaries.

Review this skill before installing if your social accounts or customer/community data are sensitive. It should be tightened to use one delivery path, ask before scraping or using connected accounts, show file changes before saving handles or ideas, and avoid including third-party @usernames except where strictly necessary in a private local report.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes collecting comments from Instagram/TikTok, potentially via scraping or user-supplied screenshots, and then sending summarized results over Telegram/email without a clear privacy notice or data-handling boundary. Because this involves third-party content and identifiers, unclear consent and transmission practices materially raise privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs the agent to modify `cerebro/f100k-config.json` with new handles and elsewhere to append ideas to `ideas/banco.md`, but it does not require explicit user confirmation or a warning before changing local files. Silent persistence of personal account identifiers and content changes can violate user expectations and make unauthorized or hard-to-audit state changes.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill declares that in OpenClaw the Friday digest should go via Telegram and be saved to a local report, but later instructs creation of a Gmail draft. This inconsistency can cause data to be sent through an unintended channel, expanding exposure of scraped third-party comments and increasing the chance of privacy, compliance, and operational errors.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The template includes third-party @usernames and quoted comments in a drafted message, while earlier instructions say those identifiers are private and must never appear in public content. Even if the digest is intended for the account owner, this creates an unnecessary exposure and increases the risk of onward sharing, retention in email systems, or accidental reuse in public-facing outputs.

Static analysis

No suspicious patterns detected.