Verosight Monitor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:11 AM UTC
• Version: 1.1.2

Overview

This skill is a coherent Verosight API integration, but users should handle API keys, JWTs, and monitoring queries carefully because they are sent to a third-party service.

Install only if you intend to use Verosight. Use test or least-privilege API keys where possible, avoid putting production keys or JWTs directly in commands, do not submit confidential or regulated monitoring targets without authorization, and pin or isolate the optional pdfkit dependency if using PDF report generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/pdf-template.md:6
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `references/pdf-template.md`, lines 6–10 **Vulnerability Type**: Uncontrolled third-party dependency resolution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npm install pdfkit ``` ``` ### Technical Analysis The installation guidance retrieves the currently resolved version of `pdfkit` and its transitive dependency tree without specifying an exact version, using a reviewed lockfile, or applying an integrity constraint. Consequently, the code installed when a user follows these instructions can differ from the code available when the Skill was audited. NPM installation may also execute package lifecycle scripts with the privileges of the user running the command. If `pdfkit`, one of its transitive dependencies, or the package registry resolution path is compromised, attacker-controlled code could execute during installation. PDF generation requires a suitable library, but mutable dependency resolution is not the minimum-risk way to provide that functionality. A reproducible, pinned dependency set should be used instead. ### Attack Path 1. An attacker compromises a future `pdfkit` release, a transitive dependency, or the relevant registry account or distribution path. 2. A user follows the Skill documentation and runs `npm install pdfkit`. 3. NPM resolves and downloads the compromised mutable dependency tree. 4. Any malicious lifecycle script executes during installation, or malicious library code executes when the report generator imports the package. 5. The payload gains the permissions of the user or Agent process performing the installation or report generation. ### Impact Assessment Successful exploitation could allow arbitrary code execution under the installing user's account. Depending on that account's permissions, the payload could access the Agent workspace, environment variables, API credentials, generated reports, and other files available to the process. ...[truncated 155 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Declare an audited, exact `pdfkit` version rather than resolving the latest compatible release. 2. Include and review a committed `package.json` and `package-lock.json`. 3. Replace the installation instruction with `npm ci`, which installs the locked dependency graph reproducibly. 4. Use `npm ci --ignore-scripts` where package functionality does not require lifecycle scripts. 5. Verify package provenance and lockfile integrity before distributing updates. 6. Run dependency installation in a minimally privileged, isolated environment without unnecessary credentials or access to sensitive workspaces. 7. Add automated dependency scanning and review all lockfile changes before release. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/verosight-auth.sh:3
• Finding: API Credentials Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/verosight-auth.sh`, lines 3–6; `scripts/quick-sentiment.sh`, lines 3–5 **Vulnerability Type**: Sensitive credentials passed as process arguments **Risk Level**: Low ### Vulnerable Code From `scripts/verosight-auth.sh`, lines 3–6: ```bash # Usage: ./verosight-auth.sh <API_KEY> # Output: JWT token to stdout API_KEY="${1:-$VEROSIGHT_API_KEY}" ``` From `scripts/quick-sentiment.sh`, lines 3–5: ```bash # Usage: ./quick-sentiment.sh <JWT_TOKEN> <QUERY> [DAYS] [SOURCES] JWT="$1" ``` The authentication script subsequently transmits the supplied API key: ```bash RESPONSE=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \ -H "X-API-Key: $API_KEY") ``` The sentiment script subsequently transmits the supplied JWT: ```bash curl -s "https://api.verosight.com/v1/analytics/sentiment?query=$QUERY&sources=$SOURCES&days=$DAYS" \ -H "Authorization: Bearer $JWT" | python3 -c " ``` ### Technical Analysis Both helper scripts encourage or require credentials to be supplied as positional command-line arguments. Command lines may be retained in shell history and exposed through process inspection, audit telemetry, terminal recording, debugging output, or orchestration logs. The authentication helper supports `VEROSIGHT_API_KEY` as an alternative, but its documented primary usage places the API key directly on the command line. The sentiment helper has no protected input alternative and requires the JWT as its first argument. The scripts send credentials only to the declared Verosight API over HTTPS; no unrelated exfiltration endpoint was identified. Nevertheless, local command-line exposure is unnecessary for the declared API functionality. ### Attack Path 1. A user runs `./scripts/verosight-auth.sh vlt_live_SECRET` or `./scripts/quick-sentiment.sh JWT_SECRET keyword`. 2. The command is retained in shell history, captured by execution telemetry, or temporarily exposed through process information ...[truncated 990 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove credential-bearing positional arguments from the documented interfaces. 2. Read secrets from protected standard input, for example with a silent prompt when a terminal is available. 3. Allow the JWT helper to read from a dedicated environment variable such as `VEROSIGHT_JWT`. 4. Where credential files are supported, require restrictive permissions such as mode `0600`. 5. Avoid examples containing live credentials directly in shell commands. 6. Document shell-history, process-list, telemetry, and CI log exposure risks. 7. Avoid printing JWTs to standard output by default; support secure in-process use or explicit protected output instead. 8. Recommend short-lived tokens, prompt key revocation after suspected disclosure, and use test keys during development. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

External Script Fetching

High

• Category: Supply Chain

Content

fi

echo "=== SENTIMENT ANALYSIS: $QUERY ==="
curl -s "https://api.verosight.com/v1/analytics/sentiment?query=$QUERY&sources=$SOURCES&days=$DAYS" \
  -H "Authorization: Bearer $JWT" | python3 -c "
import sys, json
d = json.load(sys.stdin)['data']

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

exit 1
fi

RESPONSE=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \
  -H "X-API-Key: $API_KEY")

JWT=$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null)

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes sending social-media queries and analytics requests to a third-party API but does not warn that prompts, keywords, account names, and monitoring targets may contain sensitive or regulated personal data. In an agent context, this omission can lead operators to unknowingly transmit privacy-sensitive monitoring subjects to an external service without consent review, data minimization, or policy checks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The authentication example shows use of a live-format API key and JWT exchange but gives no guidance on secure credential handling, storage, shell history exposure, or token lifetime risks. In practice, users may paste production keys into commands, scripts, screenshots, logs, or shared terminals, leading to credential theft and unauthorized API use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill includes shell-based setup and API invocation examples but does not declare any tool scope or allowed-tools constraints. In an agent environment, that omission can allow broader-than-expected shell/network use, increasing the chance of unintended command execution or data transmission when the skill is invoked.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description contains broad trigger phrases like sentiment analysis, trend analysis, and social monitoring, which can cause the skill to be invoked in contexts broader than intended. Because the skill performs external API queries and handles monitoring targets, overbroad invocation raises privacy and data-handling risk through accidental use.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to send keywords, accounts, and monitoring targets to an external social-media intelligence service without warning that these inputs may be sensitive. Users may unknowingly transmit confidential investigations, internal watchlists, personal data, or reputationally sensitive terms to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

Exchange your API key for a JWT token (valid 24 hours):

```bash
JWT=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \
  -H "X-API-Key: vlt_live_YOUR_KEY" | jq -r '.token')
```

• Confidence: 90% confidence
• Finding: This step sends an API key to an external service to exchange it for a JWT, which is expected for the integration but still constitutes external transmission of a secret. In the skill context, the danger is not the existence of the call itself but the lack of guardrails around secret handling, disclosure, and user awareness when shell commands are executed.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 3. Query Data
```bash
# Sentiment analysis
curl -s "https://api.verosight.com/v1/analytics/sentiment?query=KEYWORD&sources=x,instagram&days=7" \
  -H "Authorization: Bearer $JWT"

# Search posts

• Confidence: 88% confidence
• Finding: The sentiment query transmits user-provided monitoring keywords and source selections to an external API. In this skill's context, those queries may reveal sensitive investigations, brand-monitoring targets, or personal data, making the transmission security-relevant if users are not warned or the invocation is too broad.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $JWT"

# Search posts
curl -s "https://api.verosight.com/v1/posts?query=KEYWORD&sources=x,instagram&limit=10" \
  -H "Authorization: Bearer $JWT"
```

• Confidence: 88% confidence
• Finding: The post-search request sends keywords and platform filters to an external provider, potentially disclosing sensitive topics or persons of interest. Because the skill is aimed at cyber monitoring and reputation management, the operational context makes query confidentiality important even though the network call is functionally expected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow instructs users to export a live API key and immediately use it to obtain a bearer token and make authenticated requests to a third-party service, but it provides no credential-handling, data-sharing, or environment-safety guidance. This can lead to accidental key exposure in shell history, logs, screenshots, CI environments, or use with sensitive query terms that are transmitted off-platform.

External Transmission

Medium

• Category: Data Exfiltration

Content

export VEROSIGHT_API_KEY="vlt_live_YOUR_KEY"

# Get JWT token (valid 24h)
JWT=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \
  -H "X-API-Key: $VEROSIGHT_API_KEY" | jq -r '.token')

# Verify token works

• Confidence: 88% confidence
• Finding: This step sends an API key to an external service endpoint to obtain a JWT, which is expected for the integration but still represents third-party credential transmission. In the skill context, this is more sensitive because users may run the commands directly without realizing they are disclosing credentials and potentially sensitive monitoring targets to an external provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "X-API-Key: $VEROSIGHT_API_KEY" | jq -r '.token')

# Verify token works
curl -s "https://api.verosight.com/v1/account/balance" \
  -H "Authorization: Bearer $JWT"
```

• Confidence: 84% confidence
• Finding: The authenticated balance check transmits a bearer token to an external endpoint. While routine for API usage, bearer tokens are reusable secrets, and the workflow lacks warnings about token storage, shell/session hygiene, or preventing accidental leakage in logs and shared terminals.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Step 2: Get Sentiment Data

```bash
curl -s "https://api.verosight.com/v1/analytics/sentiment?query=KEYWORD&sources=x,instagram,tiktok&days=7" \
  -H "Authorization: Bearer $JWT" | jq .
```

• Confidence: 86% confidence
• Finding: This request sends the user's query terms and authentication token to an external analytics endpoint. In a social-monitoring skill, query terms may themselves be sensitive investigations, customer names, or incident topics, so undocumented external transmission can create confidentiality and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Step 3: Get Volume Trend

```bash
curl -s "https://api.verosight.com/v1/analytics/volume?query=KEYWORD&days=7" \
  -H "Authorization: Bearer $JWT" | jq .
```

• Confidence: 85% confidence
• Finding: The volume analytics request transmits monitoring queries and authentication data to an external provider. This is normal for the product, but without disclosure or handling guidance it can expose sensitive investigative intent and increase reliance on third-party processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Negative posts from X
curl -s "https://api.verosight.com/v1/posts?query=KEYWORD&sources=x&sentiment=negative&limit=15&days=7" \
  -H "Authorization: Bearer $JWT" | jq .

# All posts from specific platforms

• Confidence: 86% confidence
• Finding: Fetching negative posts from X through the external API transmits both authentication material and a potentially sensitive keyword/topic to a third party. Because the workflow is operational and action-oriented, users may unknowingly expose reputational, political, or incident-response investigations through these requests.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $JWT" | jq .

# All posts from specific platforms
curl -s "https://api.verosight.com/v1/posts?query=KEYWORD&sources=x,threads&limit=20&days=7" \
  -H "Authorization: Bearer $JWT" | jq .
```

• Confidence: 86% confidence
• Finding: This posts query similarly sends authenticated requests and monitoring parameters to an external service. The danger is not the existence of the call itself, but the lack of disclosure and safeguards around transmitting potentially confidential monitoring interests and handling returned data safely.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

echo "=== SENTIMENT ANALYSIS: $QUERY ==="
curl -s "https://api.verosight.com/v1/analytics/sentiment?query=$QUERY&sources=$SOURCES&days=$DAYS" \
  -H "Authorization: Bearer $JWT" | python3 -c "
import sys, json
d = json.load(sys.stdin)['data']

• Confidence: 91% confidence
• Finding: The script transmits user-supplied query data and a bearer JWT to an external third-party API. In the context of a monitoring skill this is expected behavior, but it still creates a real security/privacy boundary because sensitive search terms and credentials leave the local environment and are exposed to the remote service, logs, proxies, shell history, and process listings.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

RESPONSE=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \
  -H "X-API-Key: $API_KEY")

JWT=$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

RESPONSE=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \
  -H "X-API-Key: $API_KEY")

JWT=$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

RESPONSE=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \
  -H "X-API-Key: $API_KEY")

JWT=$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

RESPONSE=$(curl -s -X POST "https://api.verosight.com/v1/auth/token" \
  -H "X-API-Key: $API_KEY")

JWT=$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: The manifest description states coverage across X, Instagram, TikTok, YouTube, Threads, and news portals, and the documented API parameters likewise enumerate `x,instagram,tiktok,youtube,threads,news_portal`. However, the 'Supported Platforms' table additionally claims Facebook and LinkedIn support, which is not reflected in the manifest description or the documented endpoint parameters. This creates a documentation-level mismatch about the skill's actual scope.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The section explicitly defines 'Engagement Benchmarks (Indonesian social media)' but does not state that this is optional, user-selected, or limited to an Indonesia-specific use case. This can violate language/locale policy guidance when a specific locale is imposed without opt-in or clear justification.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This code performs a network request and sends a credential in the request header, but the script does not include an explicit warning, confirmation, or descriptive disclosure that the provided API key will be transmitted to api.verosight.com. For a standalone auth helper, this is safety-relevant behavior that should be clearly disclosed to users invoking the script.

Static analysis

No suspicious patterns detected.