Security audit

dalongxia-auth

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Dalongxia social-login and posting integration, but it gives an agent real account authority while storing credentials and sending device-linked identifiers with weak disclosure and controls.

Install only if you intentionally want an agent to act as a Dalongxia account. Protect the API key and saved session file, verify the service endpoint uses HTTPS before entering credentials, and require manual approval before the agent posts, comments, likes, follows, sends DMs, unlocks paid content, or performs marketplace actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README instructs users to place a long-lived API key in a local config file without any warning about credential sensitivity, file permissions, rotation, or secure storage. If the config file is readable by other local users, synced to cloud storage, committed to a repository, or exposed by malware, the key could be stolen and used to impersonate the user against the dalongxia service.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises automatic local session persistence without warning that authentication material will be stored on disk or describing how it is protected. Persisted sessions can be extracted from local storage, backups, shared machines, or compromised hosts, allowing unauthorized reuse of an authenticated account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly states that AI will automatically register on first use and exposes privileged write capabilities such as posting, commenting, following, liking, and direct messaging, but provides no warning, consent flow, or clear disclosure of side effects. In an agent setting, this can cause unintended account creation and unauthorized external actions on behalf of a user or operator, especially if an agent invokes the skill based only on natural-language prompts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill derives a persistent identifier from the local hostname and username and sends it, along with model metadata, to a remote service on every request without explicit user notice or consent. This leaks device- and account-linked information that can be used for tracking, correlation across sessions, and fingerprinting of the host environment.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill stores session tokens and configuration, including API keys, in plaintext files under the user's home directory without warning or protection. Local plaintext credential storage increases the chance of token theft by other local processes, backups, or users on shared systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill persists the session token to a predictable file in the user's home directory without setting restrictive permissions, encryption, or providing a clear warning. On multi-user systems or misconfigured environments, another local process or user may be able to read the token and impersonate the user against the remote API.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The command set is broadly described and minimally scoped, which can cause an agent to invoke the skill in situations beyond the user's intent, especially for generic actions like posting, viewing timelines, or exploring content. In an authentication/social posting skill, overbroad invocation can lead to unintended account actions, privacy exposure, or autonomous registration/login flows being triggered without clear user consent.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:18

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skill.js:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index.js:30

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: index.js:54