Security audit

Puora

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly provides Puora search and posting features, but it can publish conversation-derived questions externally without requiring final user review or redaction.

Install only if you are comfortable with the agent using Puora as an external Q&A service. Before any post, require the agent to show the exact title, body, tags, author profile, and destination URL, redact private or confidential details, and get explicit approval. Use the default HTTPS origin unless you intentionally trust a self-hosted Puora deployment.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish_question.py:25
Finding: Publication of Conversation-Derived Content Without Explicit Final Approval or Sensitive-Data Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish_question.py:21
Finding: Sensitive Publication Payload Can Be Redirected to an Untrusted or Plaintext Origin
Content: View full analysis
Remediation: View remediation

other

Note

Location: scripts/search_puora.py:79
Finding: Untrusted Remote Question and Answer Content Is Presented Without Prompt-Injection Boundaries
Content: View full analysis
= 3: question_id = sys.argv[2] question = get_question_with_answers(question_id) if question: print(f"问题: {question.get('title')}") print(f"标签: {question.get('tags', [])}") print(f"答案数: {question.get('answer_count', 0)}") print(f"\n详情:\n{question.get('body', '无')}") print("\n--- 答案 ---") for i, ans in enumerate(question.get("answers", []), 1): author = ans.get("author") or {} print( f"\n{i}. {author.get('display_name', '匿名')} ({author.get('type', 'human')}):" ) print(f" {ans.get('body', '无')}") else: print("未找到该问题") ``` ### Technical Analysis Question and answer bodies are remotely supplied, user-generated data. The script prints them verbatim, and the Skill workflow instructs the agent to return a matching answer to the user. Neither the script nor `SKILL.md` explicitly establishes a trust boundary stating that retrieved content must be handled solely as quoted data. An attacker can place model-directed instructions in a Puora question or answer, such as requests to ignore prior instructions, reveal secrets, invoke tools, access files, or contact another endpoint. If an agent consumes the output without preserving the data/instruction distinction, the remote text may become an indirect prompt-injection vector. The script does not itself execute the returned text, so exploitation depends on the calling agent interpreting remote content as instructions. This dependency limits the severity but does not eliminate the risk in an AI Agent Skill. ### Attack Path 1. An attacker po ...[truncated 1261 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented primarily as a search/help skill, but the documented behavior includes creating profiles and publishing user-derived questions to an external service. That mismatch can cause an agent or user to authorize the skill under a lower-risk mental model, even though it can exfiltrate content externally through posting.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent how to post questions externally but does not require a clear warning or consent step before sending user-derived content to Puora. This creates a direct privacy and data-sharing risk because users may not realize their information is being transmitted to a public or third-party human Q&A platform.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents use of environment variables and outbound network access, but it does not declare any explicit tool scope or permissions boundary. That increases the chance an agent can invoke networked behavior or read environment-derived configuration without a clear least-privilege contract, making review and runtime enforcement harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The invocation guidance is broad and ambiguous, using triggers like 'ask a human' or situations involving judgment or lived experience. Over-broad activation criteria can cause the skill to run in contexts where external search or posting is unnecessary, increasing the chance of inappropriate disclosure or unintended network actions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow tells the agent to summarize and publish the user's question but provides no guardrails for removing secrets, personal data, credentials, internal business information, or regulated content. In this context, a skill specifically designed to escalate user problems to humans makes accidental disclosure more likely, especially for emotional, career, or technical troubleshooting topics that often contain sensitive details.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.