T08 · Insecure Dependencies
Error
- Location
SKILL.md:23- Finding
Unpinned System-Wide Installation of a Third-Party Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
OSINT Social Analyzer
Security checks for vulnerabilities and agentic risk
Overview
This OSINT username lookup skill is mostly coherent, but it asks users to install an unpinned package into the system Python environment and can run broad cross-platform profile searches from ambiguous prompts.
Install only if you are comfortable with an OSINT tool that sends queried usernames to many external services. Use it for legitimate public-profile checks, avoid ambiguous third-party lookups, and prefer installing social-analyzer in a pinned virtual environment instead of using `--break-system-packages`.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims broad 1000+ platform investigation via
social-analyzer, but the documented workflow materially narrows behavior through a separate Chinese-platform script and a much smaller effective coverage. This mismatch can mislead users and safety systems about what data sources are queried, what outputs to expect, and what privacy-sensitive behavior the skill actually performs.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README defines very broad trigger phrases such as 'look up [name]' and 'find all accounts for X' for an OSINT skill that investigates usernames across 1000+ platforms. This can cause the agent to invoke the skill on ambiguous or low-context requests, leading to privacy-invasive lookups, unintended surveillance assistance, or over-collection of public profile data without clear user intent or authorization.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger examples are broad enough that ordinary requests like 'look up [name]' or '查一下这个用户名' could automatically invoke a powerful OSINT skill without clear user intent for cross-platform profiling. In this context, the skill performs large-scale account discovery across 1000+ services, so accidental activation can turn benign conversation into privacy-impacting reconnaissance.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes network-capable tooling (
pip3 install,python3 -m social-analyzer, and a platform lookup script) but does not declare an explicit tool scope or permissions boundary. This increases the chance of unintended network access, weakens policy enforcement, and makes it harder for a host agent to constrain what the skill is allowed to do.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The upfront description promotes wide-scale username tracing and background-check style use without an immediate privacy warning or consent-oriented framing. Because the skill is designed for broad public-profile aggregation, the lack of an early warning increases the risk of misuse for stalking, harassment, or non-consensual profiling before the later ethics note is ever seen.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger guidance is overly broad (
look up [name],check if [name] exists on social media, and similar common phrasing), which can cause the skill to activate for ambiguous requests without informed user intent. In a privacy-sensitive OSINT context, accidental invocation can initiate broad cross-platform scanning of a person’s online presence when the user may have intended something narrower.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The required summary template and confidence-tier text are written as fixed Chinese output instructions, which effectively force a specific language for responses. There is no opt-in, language selection, or justification that this skill is intended only for Chinese-language users or a region-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file hard-codes an Accept-Language preference for zh-CN and all user-facing status/output strings are in Chinese. This imposes a specific language/locale on users without opt-in or configuration, which matches the stated language/locale policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script sends the queried username to multiple third-party platforms as part of its lookup flow, but the file provides no warning, consent prompt, or documentation that the input will be disclosed externally. In an OSINT skill, this can reveal the subject of an investigation to those services, create privacy/legal issues, and leak sensitive investigative targets or user-supplied identifiers.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This code performs direct external transmission of the supplied username to Bilibili's API, which is expected for the feature but still security-relevant because it discloses user input to a third party. In the context of an OSINT investigation tool, this is more sensitive than ordinary web search because queried handles may belong to investigation targets, employees, victims, or other confidential subjects.
- Content
python # ─── Bilibili ──────────────────────────────────────────────────────────────── def check_bilibili(username): """Search Bilibili for username, return matched user info if found.""" url = f"https://api.bilibili.com/x/web-interface/search/type?search_type=bili_user&keyword={urllib.parse.quote(username)}" data = fetch(url, {"Referer": "https://search.bilibili.com/"}) if not data or data.get("code") != 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sends the user-supplied username to an external OSINT tool that queries third-party platforms, but it provides no warning, consent check, or disclosure that the lookup will transmit that identifier off-host. In a skill explicitly designed for tracing people across social platforms, this creates a real privacy risk because operators may unknowingly expose sensitive usernames, investigation targets, or their own research activity to external services.
- Content
Static analysis
No suspicious patterns detected.