Security audit

radar-tendencias-f100k

Security checks for vulnerabilities and agentic risk

Overview

This trend-alert skill is mostly purpose-aligned, but it has conflicting instructions about email versus Telegram and can read or derive local profile/config data without clear user control.

Review before installing. This skill may read local F100K profile/config files, use an Apify token if present, run web/TikTok trend searches, and send alerts. Install only if you are comfortable with Telegram-only alerts being enforced and with the missing-config behavior being clarified so it does not infer settings from broader local files without your approval.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The manifest-level OpenClaw instructions explicitly state that alerts must not send email and should go by Telegram, but FASE 5 instructs Gmail draft creation. This contradiction can lead an agent to exfiltrate trend summaries, niche data, and contact information through an unintended external channel. Because the skill handles user config and outbound messaging, conflicting instructions about communication channels materially increase data leakage risk.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation phrases include broad natural-language requests like 'dame las tendencias del día' and 'qué va a ser viral pronto', which are easy to trigger during ordinary conversation. That increases the chance the skill runs unintentionally, causing web searches, token-dependent scraping, local config reads, and outbound alerts without the user meaning to invoke this specific automation. In an agent environment with external tools, over-broad triggers are a legitimate security boundary weakness.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The OpenClaw wrapper says that if `cerebro/f100k-config.json` does not exist, the skill should create it from other files and confirm by Telegram, while FASE 1 later says to stop and instruct the user to run another routine. This conflict can cause an agent to take unintended autonomous actions, including synthesizing config from other local data sources without clear user approval. In a system that reads user files and sends notifications, contradictory control flow is a real security and safety risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill directs the agent to read `cerebro/f100k-config.json`, infer configuration from `USER.md` and `cerebro/`, and conditionally use `APIFY_TOKEN`, but it does not require any explicit notice or consent before accessing potentially sensitive local data or secrets. This is dangerous because users may not realize the skill is inspecting configuration files, niche/business metadata, or environment-backed credentials as part of a casual trend request. The surrounding context makes this more serious because the same skill also performs outbound network queries and notifications.

Static analysis

No suspicious patterns detected.