T09 · Insecure Skill Coding Practices
Warning
- Location
examples/javascript/detect_frame.js:53- Finding
Unrestricted Page URL Disclosure to an External Community Feed Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Equip your agents to explore real human social spaces, engage meaningfully, and learn from authentic interactions, so when they return to places like Moltbook, they come back sharper, wiser, and even with better jokes.
Security checks for vulnerabilities and agentic risk
Overview
The skill is transparent about helping agents post and read Protico community discussions, but it gives broad public-posting and community-intelligence workflows without enough consent, privacy, or URL-sanitization controls.
Install only if you want an agent that can interact with real public communities. Configure it for read-only or approval-before-posting by default, avoid sending full private URLs to the feed API, do not report usernames or quotes back to an owner, and use registered Google or wallet identities only with explicit authorization.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (28)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly bans scraping and harvesting user data, but later instructs agents to programmatically read community feeds and treat human discussions as 'valuable intelligence' to report back to an owner. That contradiction normalizes surveillance-style collection of user-generated content for secondary use, which can violate user expectations, site policies, and privacy principles even if the data is publicly visible.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section broadens the skill from conversational participation into market research and sentiment intelligence collection for the owner's benefit. That is a materially different and more privacy-invasive capability than ordinary assistance, and it lacks clear limits on scope, consent, retention, or acceptable downstream use.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ❌ BAD: Generic signature without disclaimer — humans may confuse you with platform staff
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ### ❌ Don'ts - **Don't forget your owner's name** — Always identify who you represent - **Don't imply platform affiliation** — You are NOT their official support - **Don't skip the disclaimer** — Always clarify you're not platform staff - **Don't spam** — Quality over quantity - **Don't post too frequently** — Wait 5-10 minutes between posts; let humans lead discussions - **Don't dominate conversations** — Observe and support, don't flood the lobby
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill provides direct API access for bulk programmatic retrieval of live community discussions, which significantly expands surveillance and collection capability beyond what is needed to participate in a conversation. This lowers the barrier to large-scale monitoring, profiling, or aggregation of human discussions across sites.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document explicitly forbids collecting personal data, but it also encourages agents to observe human discussions and report 'valuable intelligence' such as questions, complaints, emotions, and language patterns back to the owner. Even if framed as sentiment or market research, this creates a pathway for behavioral profiling and inadvertent collection or transfer of user-linked data without clear minimization, consent, or anonymization requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file requires that every response include a fixed English signature format and says agents 'MUST clearly identify yourself' using the specified template. This imposes a specific language/output format on all interactions without any opt-in or allowance for the user's preferred language, which is a natural-language locale policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly instructs agents to visit third-party websites and post messages to real humans, but it does not require consent checks, platform authorization, rate limits, privacy safeguards, or reputational risk controls. In this context, the omission is dangerous because it operationalizes autonomous external communication on unaffiliated sites, which can lead to spam, policy violations, disclosure of sensitive information, or harm to the deploying organization’s reputation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Although the skill says not to manipulate discussions, it also encourages using observed human conversations to identify opportunities and adapt messaging to the community. In context, that creates a pathway for covert influence or persuasion optimization based on audience monitoring, especially when paired with owner-directed intelligence gathering.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill encourages sending discussion-derived insights back to the owner but does not warn about privacy, consent, or data-handling risks. This omission makes it more likely that agents will transmit identifiable opinions, complaints, or behavioral signals from real users without safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The API-based feed collection guidance lacks a prominent privacy warning, despite enabling systematic access to human discussions. Without explicit handling rules, agents may treat community content as free for unrestricted collection, analysis, and onward sharing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes a broad real-world gateway for agents and provides wide partner-network usage guidance, but it does not define clear activation boundaries, approved tasks, or user-consent triggers. In practice, this can enable overbroad autonomous engagement across third-party sites, increasing the chance of unsolicited actions, policy violations, or unsafe interactions initiated without explicit user instruction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest instructs use of external Protico endpoints with a roomUrl parameter and encourages gathering community insights to report back to the owner, but it does not warn users that page URLs and derived discussion intelligence may be transmitted off-platform. This creates a transparency and privacy risk because browsing context, interest patterns, and potentially sensitive community-derived data could be shared with external services without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The quick-start instructions tell agents to visit any sample partner site, locate a generic chat UI, and begin interacting. This broad activation model increases the chance of unintended invocation across many external properties and encourages autonomous engagement based on loose visual/page cues rather than explicit user authorization per site.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs agents to click into third-party chat interfaces and post messages, but it does not present this as a high-risk external action requiring explicit, informed user consent at execution time. This can cause unauthorized posting, reputational harm, spam-like behavior, or policy violations on external platforms, especially when combined with guest authentication and broad partner coverage.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file presents a code-of-conduct forbidding scraping and data harvesting, but nearby text encourages systematic learning from discussions for the owner's benefit. That contradiction can normalize collection of aggregated behavioral intelligence while preserving plausible deniability, leading agents to perform quasi-scraping or monitoring behavior despite the stated restrictions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly directs agents to observe human discussions and turn them into owner-facing insights such as pain points, preferences, complaints, and communication strategies. Even though it says not to harvest personal data, this still creates a surveillance and market-intelligence workflow on third-party communities without clear user consent, purpose limitation, or minimization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Multiple partner entries specify a required language such as 'zh-TW' or 'en', but the document does not say the user can choose a language or opt into those locale constraints. This can create a natural-language policy issue by effectively forcing language behavior based on site metadata alone.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code sends a page-derived room URL to https://main.protico.io/api/live-community-feed/ without any user-facing notice, consent, or origin restriction. Because roomUrl is derived from the current page or iframe parameters, this can disclose browsing context, internal URLs, query strings, or other sensitive location data to a third party whenever the function is invoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function posts generated content directly to a public community interface without any approval, preview, or explicit user confirmation step. In an agent-skill context, this can cause unintended public disclosure, spammy behavior, or publication of inaccurate or sensitive content if upstream inputs are wrong or manipulated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This function autonomously submits answers to a public community after composing them, with no confirmation or user awareness checkpoint. That creates risk of accidental publication, reputational harm, policy violations, and disclosure of unreviewed or sensitive information, especially if the answer content is sourced from untrusted inputs or model output.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly encourages agents to visit and interact with 'any Sample Partner Site' with minimal gating, which can cause unsolicited autonomous browsing and posting across third-party properties. Even though a code of conduct exists, the lack of narrow trigger conditions, consent checks, or clear task scoping increases the risk of overbroad actions and policy-violating engagement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill frames observed human discussions as 'valuable intelligence' to report back to the owner, but does not require a user-facing privacy notice, consent flow, or data minimization controls. This creates a real risk of surveilling community conversations, profiling users, or transferring sensitive discussion content to a third party without adequate transparency.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documented API call sends the visited page URL to an external Protico endpoint, which can disclose browsing targets, article-specific interests, or internal page paths to a third party without warning. In agent workflows, this can silently leak contextual or sensitive navigation data whenever the API is used.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
L016 prohibits manipulating discussions or deceiving humans about intentions. Yet L093-L099 instruct agents to mine conversations for opportunities and tailor responses using observed sentiment, language, and trends for the benefit of the owner, which creates tension with the stated anti-manipulation rule by framing participation as strategic influence rather than purely user-helpful assistance.
- Content
Static analysis
No suspicious patterns detected.