Cocreator Content Research

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:53 AM UTC
• Version: 1.0.2

Overview

The skill's runtime behavior is mostly coherent read-only social media research, but its automatic uv installer runs an unverified remote shell script during installation.

Install only if you are comfortable with ScrapeCreators receiving the searched keywords, creator handles, and API key. Avoid the automatic `curl | sh` uv installer unless you trust that channel; prefer installing uv separately through a trusted, pinned, or verified method before enabling the skill.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Unverified Remote Installer Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 14–20 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```json { "id": "uv-install", "kind": "bash", "script": "curl -LsSf https://astral.sh/uv/install.sh | sh", "bins": ["uv"], "label": "Install uv (cross-platform via bash)" } ``` ### Technical Analysis The installation command downloads content from `https://astral.sh/uv/install.sh` and streams it directly to `sh`. The downloaded payload is not pinned to a specific version, stored for inspection, checksum-verified, or authenticated with a separately verified signature. Although the Astral endpoint is consistent with the declared `uv` prerequisite, the effective installer can change after the Skill has been reviewed. A compromise of the remote endpoint, its hosting infrastructure, DNS resolution, or the relevant TLS trust chain could therefore turn Skill installation into arbitrary code execution. This behavior exceeds the minimum privileges required for the declared social-media research functionality. The runtime scripts only need an available Python environment, the `requests` dependency, and access to the ScrapeCreators API; they do not inherently require mutable remote shell code to be executed during installation. ### Attack Path 1. A user or agent initiates installation of the Skill prerequisite. 2. The installation framework invokes the configured Bash command. 3. `curl` retrieves the current response from `https://astral.sh/uv/install.sh`. 4. The response is passed directly to `sh` without local review or integrity verification. 5. If the response has been maliciously altered, arbitrary shell commands execute with the privileges of the account performing installation. 6. Those commands could access user-readable data, modify user-owned files and configuration, install additional payloads, or perform network operations. ...[truncated 688 chars]
• Remediation: ## Remediation Suggestions 1. Remove the automatic `curl | sh` installation command and treat `uv` as an externally managed prerequisite. 2. Direct users to install `uv` through a trusted operating-system package manager or another controlled software-distribution mechanism. 3. If automated installation is essential: - Pin an exact `uv` release. - Download the release artifact to disk rather than streaming it into a shell. - Verify a published cryptographic checksum or signature obtained through a separately trusted channel. - Abort installation if verification fails. - Inspect and execute only the verified artifact. 4. Run installation under an unprivileged account and avoid `sudo` or administrator execution. 5. Where possible, replace runtime dependency resolution with a locked dependency set and verified hashes to improve reproducibility and reduce supply-chain exposure. 6. Document the expected files and environment changes made by prerequisite installation so users can assess its scope before approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code does align with part of the description: it performs read-only intelligence gathering via ScrapeCreators and does not generate content or post. However, the declared description overstates the implemented functionality. The script only searches TikTok by keyword/hashtag and Instagram Reels by keyword, then ranks top content by views. There is no implementation for specific creator profile lookup, no direct competitor profile/strategy retrieval beyond inferring from searched content, and no general Instagram profile intelligence. Thus the description is materially broader than the actual behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares network and environment-dependent behavior but does not define any explicit tool scope or allowed-tools boundary. In agent environments, this can lead to overbroad execution authority, making it easier for the skill to access secrets or perform unintended outbound requests beyond the user's expectation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends the user's query parameters and an API key to an external service via HTTP requests, but the script provides no visible warning, confirmation, or explanatory comment about that outbound data transmission. Under the code-file criteria, network calls that transmit user or system data should have some form of user disclosure unless the behavior is clearly disclosed elsewhere in the skill description.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends the provided social-media handle and API key to a third-party service via requests.get, but the file contains no comment, docstring, or user-facing notice explaining that external network transmission occurs. Because network calls that transmit user or system data require some form of disclosure for code files, this operation should be explicitly communicated.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Script Fetching

Low

• Category: Supply Chain

Content

{
          "id": "uv-install",
          "kind": "bash",
          "script": "curl -LsSf https://astral.sh/uv/install.sh | sh",
          "bins": ["uv"],
          "label": "Install uv (cross-platform via bash)"
        }

• Confidence: 97% confidence
• Finding: Piping a remote script directly into sh executes unverified code from the network at install time, creating a supply-chain and remote code execution risk. If the upstream host, transport, or installer content is compromised, the agent environment can be fully compromised, including exposure of SCRAPE_CREATORS_API_KEY and other accessible data.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The manifest frames this skill as analysis that relies on ScrapeCreators data, but does not indicate any need to access host environment secrets. Reading `SCRAPE_CREATORS_API_KEY` from environment variables introduces credential access behavior beyond the stated research function, even though it is used only to call the declared upstream service.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The script reads the SCRAPE_CREATORS_API_KEY secret from the environment and uses it for external API requests. While this is common practice, the file lacks a docstring or comment warning users that a credential is required and will be used for third-party requests.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This Python code sends the provided social-media handles to third-party ScrapeCreators endpoints via HTTP requests. Although the network calls are visible in code and errors are printed, there is no user-facing warning, prompt, or explanatory comment/docstring disclosing that input data will be transmitted to an external service.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The script reads SCRAPE_CREATORS_API_KEY from the environment, which is a sensitive credential source, but there is no explanatory comment, docstring, or warning describing that the skill accesses credentials from environment variables. For this category, credential access in code should have some visible disclosure unless already documented elsewhere.

Static analysis

No suspicious patterns detected.