Agent Social Reader

• Outcome: Review
• Latest audit: Jul 14, 2026 · 9:42 AM UTC
• Version: 2.0.1

Overview

The skill’s sensitive behaviors are disclosed and tied to its reader, transcription, and save workflows, but users should be careful with optional web search, cloud upload, and plaintext credential configuration.

Install only if you are comfortable with optional web search fallback, possible cloud transcription of media, and service credentials being read from environment variables or an approved local config file. Prefer environment variables or a secret manager over plaintext config, and require explicit confirmation before cloud uploads or saving to external services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The routing map explicitly includes a general web search capability, which expands the skill beyond its stated scope of operating on a specific user-provided URL. That broader capability can cause the agent to fetch unrelated external content, increasing data exposure, prompt-injection surface, and the chance of acting on information the user did not explicitly authorize.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The fallback SOP instructs the agent to use runtime web search if direct parsing fails, which materially broadens the skill from 'read this specific link' into independent discovery. In a hostile web environment, this can lead the agent to ingest attacker-controlled search results or unrelated pages, making prompt injection and unapproved browsing more likely.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _get_ima_credentials():
    """Load ima credentials from env vars or config files."""
    client_id = os.environ.get("IMA_CLIENT_ID")
    api_key = os.environ.get("IMA_API_KEY")
    if client_id and api_key:
        return client_id, api_key

• Confidence: 76% confidence
• Finding: This helper retrieves API credentials from environment variables and, if absent, falls back to plaintext files under the user's home directory. In an agent skill, automatic access to secrets and local config can become dangerous if the save path is triggered unexpectedly or if untrusted content influences when the helper is called, because it expands the skill's access to sensitive credentials beyond user-supplied inputs.

External Transmission

Medium

• Category: Data Exfiltration

Content

f"Content-Type: audio/wav\r\n\r\n"
    ).encode('utf-8') + audio_data + f"\r\n--{boundary}--\r\n".encode('utf-8')
    req = urllib.request.Request(
        "https://api.openai.com/v1/audio/transcriptions",
        data=body,
        headers={
            "Authorization": f"Bearer {api_key}",

• Confidence: 81% confidence
• Finding: This flow uploads extracted audio content to the OpenAI Whisper API, which can contain sensitive spoken information from user-requested media. Although the file says to do this only if the user chooses API transcription, the skill handles full media-derived content and external transmission of that content creates a real privacy and data-governance risk if consent is unclear or defaults are misapplied.

Session Persistence

Medium

• Category: Rogue Agent

Content

## ⚠️ Workspace Rules

**CRITICAL: Never create or modify files directly inside the agent's default workspace unless the user explicitly asks for a workspace artifact.**
- Use `/tmp/` for all temporary outputs and transient cache.
- Prefer platform secret storage, existing authenticated connectors, or environment variables for secrets.
- Use `~/.agent-social-reader/config.json` only after the user explicitly agrees to local plaintext configuration.

• Confidence: 92% confidence
• Finding: The skill authorizes persistence to local plaintext configuration in the user's home directory after approval, including storage of API keys and service identifiers. Even with consent, local plaintext secret storage increases the risk of credential theft from other local processes, backups, logs, or accidental sharing, and creates durable state outside the immediate session.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/save-scripts.md:311