Security audit

radar-contenido-f100k

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a content-research radar, but it contains conflicting instructions about whether it uses a logged-in Instagram session and private saved posts.

Install only if you want an agent to maintain a local Instagram-format research radar and you are comfortable with Apify/Higgsfield/Telegram use and local reports. Before using it, confirm the agent follows the OpenClaw path only: no logged-in Instagram browser session, no scraping saved posts, and saved Reels added only from links you explicitly send.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata promises 'Nunca usa una sesión logueada', but the body documents checking for a logged-in Instagram browser session and using it to access Instagram content. That mismatch is dangerous because operators may authorize the skill under a lower-risk assumption while it actually processes authenticated account data, increasing privacy and session-exposure risk.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill instructs navigating to the user's saved Instagram posts and extracting Reel links from their private saved content, which exceeds the declared intake model of Telegram-forwarded links. Accessing saved items through the user's live session expands data access to private behavioral data the user may not expect the skill to mine automatically.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation list includes broad phrases such as 'qué formatos están despegando' and 'busca storytelling en Instagram', which could plausibly occur in ordinary brainstorming or research conversations unrelated to this specific skill. Although some negative examples are provided, the trigger set is not tightly scoped to explicit invocation wording, increasing the risk of unintended activation.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The 'Solo leer' rule frames the skill as passive and safe, but nearby instructions still rely on the user's authenticated Instagram session and saved content. This kind of misleading safety framing can cause users to underestimate the sensitivity of the data being accessed and the trust boundary being crossed.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill creates configuration, registry, run-output, and report files, but the user-facing description does not clearly warn that local filesystem changes will occur. Silent file creation is a trust and safety issue because it can surprise users, persist sensitive derived data, and complicate cleanup in shared environments.

Static analysis

No suspicious patterns detected.