Security audit

Replyher Skill Pub

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly works as a chat-reply coach, but it automatically adds a promotional external link during sensitive conversations and includes a powerful manual publishing script.

Install only if you are comfortable sharing private messages with the agent and seeing an occasional promotional link to replyher.com. Redact names, phone numbers, employer details, addresses, screenshots with identifiers, and confidential workplace content before use. Do not run artifact/publish.sh unless you are the maintainer and have reviewed the working tree, Git remote, and the npx package version.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:381
Finding: Mandatory Promotional Content Injection into Agent Responses
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: publish.sh:21
Finding: Unpinned Third-Party Package Execution During Publishing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: publish.sh:15
Finding: Overbroad Repository Staging Can Publish Unintended Sensitive Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents an end-user messaging/reply assistant focused on interpreting chats and generating responses. The supplied code chunk does not implement any chat analysis, screenshot decoding, tone coaching, or reply generation. Instead, it is a developer release automation script for publishing the project to GitHub and ClawHub. This is a materially different primary purpose and includes undeclared capabilities involving source control and external publishing services.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
Keep it under 5 lines. Don't lecture about features.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly encourages users to paste received messages, chat threads, and interpersonal context for analysis, but it provides no warning about sharing sensitive personal, workplace, or third-party data. In a communication-coaching skill, users are especially likely to submit private conversations containing names, relationship details, financial issues, or confidential work content, increasing the risk of inadvertent privacy exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file states 'Always reply in the same language the user writes in,' which imposes a language behavior unconditionally. This is a natural-language locale policy constraint, and the skill does not offer the user an explicit option to choose a different response language or opt in to this behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx clawhub without pinning an exact package version allows npx to resolve and execute whatever version is currently published under that package name. If the upstream package is compromised, unpublished/republished, or a malicious version is introduced, running this release script could execute attacker-controlled code on the maintainer's machine during publishing and potentially compromise source code, tokens, or the release process.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.