Plausible

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:59 PM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for querying Plausible Analytics, but it can send an API token to a custom stored endpoint without clear validation or confirmation.

Install only if you are comfortable storing Plausible site configuration locally and sending PLAUSIBLE_API_KEY to the configured Plausible host. Prefer the default plausible.io endpoint unless you intentionally use a trusted self-hosted Plausible instance, and verify any custom Base URL before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:101

Finding

Bearer Token Exposure Through an Unvalidated Custom Base URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:101-109, with related configuration in setup.md:28 and memory-template.md:18-20
Vulnerability Type: Unvalidated credential destination
Risk Level: High

Vulnerable Code Snippet

From SKILL.md:

markdown

Self-hosted instances use custom base URL from memory.md.

No other data is sent externally.

## Security & Privacy

**Data that leaves your machine:**
- Site ID (domain) and query parameters sent to Plausible API
- API key sent as Bearer token

Related configuration from setup.md:

markdown

In `~/plausible/memory.md`:
- Site IDs (domains) they track
- Base URL (plausible.io or self-hosted)
- Preferred default time period
- Common query patterns
- Goals/events they care about

Related template from memory-template.md:

markdown

## Base URL
<!-- plausible.io (default) or self-hosted URL -->
<!-- Example: https://analytics.example.com -->

Technical Analysis

The skill permits an arbitrary self-hosted base URL to be stored in persistent memory and directs authenticated requests to that destination. Those requests include PLAUSIBLE_API_KEY as a bearer token.

The instructions do not require HTTPS, validate or allowlist the destination hostname, prohibit embedded credentials or redirects, block loopback and link-local addresses, or require user confirmation before sending the token to a newly configured host. As a result, an incorrect or attacker-influenced base URL can redirect the API credential to an unintended server.

Although the skill correctly obtains the secret from an environment variable rather than storing it in plaintext, environmental secret storage does not prevent disclosure when the secret is transmitted to an untrusted destination.

Attack Path

1. An attacker, misleading user input, or corrupted configuration causes a hostile URL to be written into the Base URL section of ~/plausible/memory.md.
2. During a later analytics query, the agen ...[truncated 985 chars]

Remediation

View remediation

Remediation Suggestions

1. Default exclusively to https://plausible.io unless the user explicitly enables a self-hosted endpoint.
2. Require custom base URLs to use HTTPS and reject HTTP, non-web schemes, embedded credentials, malformed hosts, and ambiguous URL forms.
3. Resolve and reject loopback, link-local, multicast, private-network, and cloud-metadata destinations unless a narrowly scoped local deployment has been explicitly approved.
4. Show the normalized destination hostname and request explicit confirmation before sending credentials to a custom host for the first time or after the host changes.
5. Bind each API credential to an approved hostname rather than automatically sending one global environment token to any configured base URL.
6. Revalidate the destination after redirects and never forward the authorization header across origins.
7. Protect ~/plausible/memory.md with restrictive filesystem permissions and treat its endpoint configuration as security-sensitive.
8. Document credential rotation procedures and advise immediate rotation if an unauthorized endpoint may have received the token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup instructions explicitly direct the agent to persist user/site configuration in ~/plausible/memory.md, including tracked site IDs, base URL, preferred defaults, and goals/events, but provide no instruction to notify the user or obtain consent for local persistence. While this is not secret material like the API key, it is still operationally sensitive analytics metadata and can create privacy, multi-user, or cross-session data leakage risks if stored silently.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.