Security audit

FoodLoop Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a FoodLoop API analyzer, but it also encourages live state-changing API calls and uploading user photos without clear authorization or consent safeguards.

Install only if you will use it on FoodLoop deployments you own or are explicitly authorized to test. Before running it, avoid live POST tests unless you are in a test environment, do not upload personal or sensitive photos without consent, and clean up any saved reports or temporary image files afterward.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is framed as an analyzer but instructs active interaction with live application functionality, including authentication and state-changing API calls. That expands the operation from passive inspection into unsolicited testing against third-party systems, which can trigger unintended side effects, alter data, or violate authorization and usage boundaries.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The skill writes analysis artifacts to the local filesystem without disclosing that behavior in the skill description or warning the operator. Undisclosed local persistence can expose sensitive target data, backend URLs, API schemas, and test results to other local users, later processes, or unintended retention.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The photo-upload workflow goes beyond deployment analysis by instructing the agent to decode chat-provided image data, store it locally, and transmit it to a backend endpoint. This introduces unnecessary handling of user content and data exfiltration risk unrelated to the core purpose of mapping a FoodLoop deployment.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The reference includes a demo-auth flow and account-oriented endpoints in a skill whose stated purpose is reverse-engineering and analysis. That expands the agent from passive inspection into actions that can create or affect user/account state on a live backend, which is unsafe for an analyzer skill and could enable unauthorized interaction or misuse of demo access.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: These endpoints include session start/finish/stop/progress and notification preference changes, which modify live application state rather than supporting analysis or audit. In the context of a reverse-engineering skill, documenting and encouraging use of operational endpoints creates a capability for unintended tampering with production data and user workflows.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documented feedback and contact submission endpoints allow sending user-associated content to the live service, which is unrelated to reverse-engineering or audit. An agent using these endpoints could generate spam, pollute production datasets, or submit personal data without necessity or authorization.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Webhook-management and bot-ingestion endpoints are sensitive operational surfaces that can change integrations or inject external messages into the system. Including them in a general analyzer skill materially increases the risk of service disruption, message spoofing, or interference with production bot behavior.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The config-status example reveals environment and feature-configuration details such as database type and whether external providers are configured. While not directly exploitable by itself, this kind of reconnaissance guidance helps map the backend and can aid follow-on attacks or targeted probing.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The instruction to save results to a local file omits any warning that potentially sensitive analysis data will be persisted on disk. Even if low severity, silent persistence can create privacy, retention, and cross-session exposure issues in shared or managed environments.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This workflow silently writes chat-supplied image data to /tmp and then uploads it to a backend, creating both local exposure and remote transmission risks. Because the data originates from chat, the user may not expect that their content will be materialized on disk and sent to an external service.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The workflow instructs saving and uploading user photos, along with optional user identifiers and context, to a live backend without any notice about transmission, storage, retention, or consent. For an agent skill, this creates privacy and compliance risk because users may not understand that image data and metadata are being persisted or processed externally.

Static analysis

No suspicious patterns detected.