T09 · Insecure Skill Coding Practices
Error
- Location
references/graph-schema.md:143- Finding
Fail-Open API Authentication Exposes Journal-Derived Metadata and Rebuild Operations
- Content
View full analysis
- Remediation
View remediation
Security audit
brain-map-visualizer
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent local brain-map visualizer, but its provided API examples can expose journal-derived private data and rebuild actions if deployed as documented.
Review and harden the API route examples before installing on anything reachable beyond localhost. Use one server-only secret name consistently, fail closed when auth is missing, do not place access keys in NEXT_PUBLIC variables, restrict rebuilds to trusted users, and review the generated graph JSON because it can contain sensitive journal summaries and file-path metadata.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Copy `references/journal-parser.md` into a Node.js script at `scripts/build-brain-map-projects.js` in your Mission Control or host app. Adjust `WORKSPACE_DIR` a
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Copy `references/journal-parser.md` into a Node.js script at `scripts/build-brain-map-projects.js` in your Mission Control or host app. Adjust `WORKSPACE_DIR` a
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md keywords: [ 'github', 'git push', 'git commit', 'pull request', 'pr #', 'merge', 'feature branch', 'main branch', 'hno-skills', 'ghost-theme', 'pr open', 'pr merged', 'pat', 'personal access token', ], }, {
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation at L176-L179 says a single click opens a node's file in project view, which directly conflicts with the earlier behavior description at L104-L116 that first click reorbits and second click opens. This is an active contradiction in the skill's own intent documentation about a user-visible interaction model.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The installation instructions tell users to run
npx servewithout pinning a specific version. That causes execution of whatever package version the registry resolves at runtime, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly. In this skill's context, the command is presented as a routine way to host the app, which increases the chance users will execute it directly.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
L321 states promotion is a local configuration write within the parser's existing output scope, while L140-L145 and L305 describe promotion and category customization as affecting named Attention Pocket configuration or PROJECT_DEFS. Those are different write targets: output JSON scope versus parser/config definition scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file description says the component has a left panel showing attention projects ranked by recency-weighted density and a right panel graph for the selected project. However, the implemented
BrainMapGraphonly fetches one graph dataset and renders an SVG visualization with stats, legend, focus label, and tooltips; there is no project list UI or project-selection behavior matching that description.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document does not prominently warn that the script ingests journal contents and persists derived summaries and file-access metadata into an output JSON file. Because journals may contain sensitive operational details, users may run it without understanding the privacy and data-handling implications, increasing risk of unintended local exposure or downstream publication.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Files Accessed
- MEMORY.md
- memory/recent.md
- skills/ghost-publishing-pro/SKILL.md
text **Pass 2 — transcript regex fallback**
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script performs filesystem checks, reads journal files, and later writes output at module top level before the exported API is intended to be used. If another component imports this module expecting a pure library, it can trigger unexpected local data processing, process termination via process.exit(1), and file writes as an import side effect.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file includes a quoted agent prompt that begins with broad imperative language: 'Read my session history from [source] and generate a journal entry for each session...'. Because the prompt is presented as a reusable invocation without scope limits or negative examples, it could overlap with general summarization requests and trigger use of this skill in contexts beyond the intended journal-bootstrap workflow.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents that a
brain-map:open-fileevent is emitted so the host page can read and display a file, but it does not include a user-facing warning that interacting with the graph may trigger local file access. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The note says the component is 'fully self-contained — no external state, no context dependencies,' but the same file documents and the code demonstrates dependencies on
/api/brain-map/graphand a host listener forbrain-map:open-file. Those external runtime dependencies mean the component is not actually self-contained in the ordinary sense.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest frames the skill as visualizing attention movement, which suggests presentation-oriented behavior. This file actually performs data extraction from
memory/journal/*.md, project classification, graph construction, and writes a JSON artifact to disk, which is a broader analytics/build step than visualization itself.- Content
Static analysis
No suspicious patterns detected.