Rumour Buster

• Outcome: Review
• Latest audit: May 28, 2026 · 4:46 AM UTC
• Version: 0.3.0

Overview

This fact-checking skill is mostly purpose-aligned, but it embeds and handles API credentials in risky, under-disclosed ways.

Review this skill carefully before installing. Do not paste sensitive messages, private URLs, or secrets into verification prompts. If you use Tavily, remove or ignore the embedded default key, use your own credential only if you accept plaintext local storage, and delete ~/.rumour-buster-config when you no longer need it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'payload' from os.getenv (line 25, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

}
    
    try:
        response = requests.post(url, json=payload, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

• Confidence: 99% confidence
• Finding: The script embeds a hardcoded fallback Tavily API key via os.getenv(..., <secret>) and then transmits it in an outbound request body to a third-party service. This exposes a credential to anyone with code access and can enable unauthorized API use, billing abuse, and possible revocation of the legitimate service account; in this fact-checking skill context, automatic external transmission also increases privacy risk because user queries are sent off-platform.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes capabilities that require network access, reading configuration, and writing a config file, yet no permissions are declared. This creates a transparency and consent problem: users and the host may not realize that queries, URLs, and API credentials can be transmitted externally and persisted locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The documented behavior omits sensitive side effects: creating ~/.rumour-buster-config and storing Tavily API credentials there. Undisclosed credential storage and any hardcoded default API key fallback materially change the risk profile, because they can leak secrets, cause unauthorized API use, or make users rely on behavior they never consented to.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The setup documentation explicitly persists a Tavily API key in a plaintext file under the user's home directory. Storing third-party credentials unencrypted and beyond immediate use creates unnecessary secret-retention risk: other local users, malware, backups, logs, or support tooling could recover the key and abuse the quota or linked account.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The setup script persists the Tavily API key in plaintext under the user's home directory, creating a local secret-exposure risk if the file is read by other users, backup tooling, logs, or later reused insecurely. Storing third-party credentials is not inherently malicious here, but doing so without protection or a stronger justification increases the attack surface for a rumor-verification skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README encourages users to submit arbitrary text and URLs for verification through multiple external search engines, but it does not disclose that those inputs may be transmitted to third-party services. This creates a real privacy and data-handling risk: users may paste sensitive messages, private links, internal URLs, or confidential claims without understanding they may be shared externally across several providers.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Using a generic manual trigger like "setup" is prone to accidental invocation during normal conversation or unrelated troubleshooting. In this skill, accidental invocation is more dangerous because setup can write configuration files and potentially prompt for or persist API credentials.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Automatic first-use setup is ambiguously scoped and may run without a clear user request. Because setup includes dependency checks, config generation, and possible API configuration, unintended activation can lead to unexpected file writes, external calls, or secret handling without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill sends user-provided messages and URLs to multiple third-party search providers, but the description does not clearly warn users of this data sharing. This can expose sensitive queries, private URLs, or regulated content to external services, especially when cross-engine searching multiplies disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The automatic setup flow does not disclose that it will create a config file in the user's home directory and may store API credentials. Hidden persistence of configuration and secrets can surprise users, increase local secret exposure, and complicate cleanup on shared or managed systems.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: A real API key appears directly in source code, and the script automatically sends both that credential and user search content to Tavily without any meaningful disclosure or consent flow. This creates two security issues: secret exposure in the repository and unannounced third-party data transmission, which is especially sensitive in a tool that may process user-provided claims, names, or other potentially sensitive text.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The flow asks the user to paste a live API key directly into chat without warning how that secret will be handled or stored. Chat transcripts are often retained by platforms, visible to operators, and accessible in later context windows, so requesting credentials in-band materially increases exposure risk.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documented config includes the API key in plaintext but gives no privacy or security warning. Normalizing silent credential persistence increases the chance users will disclose and retain secrets without understanding the local exposure, backup leakage, or compromise implications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script asks the user for an API key and later writes it to disk, but it never clearly warns that the credential will be stored persistently in a config file. This undermines informed consent and can lead users to expose secrets they expected to be used only transiently.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: Instructing users to paste a live API key into chat is a direct credential-exposure anti-pattern. Because the skill context is a setup assistant rather than a dedicated secure secret manager, the request is less justified and more dangerous: the secret may be captured in transcripts, memory, analytics, screenshots, or downstream tool logs.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: Persisting the Tavily API key in plaintext institutionalizes unsafe retention of user-provided credentials. This materially raises the blast radius of any local compromise and is not strictly necessary for rumor verification if safer secret-storage alternatives exist.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The reset flow displays part of the stored API key back to the user in chat, which encourages the assistant to reveal credential material from storage. Even a prefix can aid correlation, confirm possession of a valid secret, and normalize secret disclosure in conversational history.

Static analysis

No suspicious patterns detected.