Security audit

Authentic Bot

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent guidance for AI community participation, but it includes tactics that could make automated posting look less automated and could manipulate engagement signals.

Review this before installing if you plan to let an agent post publicly. It should only be used with explicit human approval, visible AI/bot disclosure, platform-approved APIs or labels, and community-rule checks. Remove or override the advice about varying behavior to avoid looking automated, and do not let an AI account vote or react systematically.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These instructions move beyond transparent participation and into behavioral shaping designed to avoid automated detection signals, such as uniform cadence and repeated lengths. Even though the skill claims authentic disclosure, advising operators to vary timing/length and avoid 'covert automation' patterns can be used to make bot activity less detectable and increases the risk of platform-rule evasion.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill says it opposes detection evasion, but it also instructs the agent to vary timing and behavior specifically because regularity 'looks automated.' That creates a practical concealment tactic: even with profile disclosure, the operational guidance encourages reducing detectable bot signals, which can be used to bypass community scrutiny or platform anti-bot heuristics.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This section condemns covert automation, yet recommends 'vary everything' and explicitly compares desired behavior to messy human patterns. That contradiction weakens the anti-deception stance and provides human-mimicry guidance that could be repurposed to make automated participation less detectable by users or moderators.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Telling the agent to upvote the post and several comments when participating encourages engagement manipulation rather than authentic contribution. This can distort ranking and reputation signals and may violate platform rules, especially when performed systematically by automated or semi-automated accounts.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description says to use the skill whenever an AI agent needs to 'participate in online communities' or 'engage in discussions as itself,' which is broad and lacks explicit constraints or negative examples beyond impersonation and evasion. That wording could overlap with many ordinary posting situations, making activation scope ambiguous.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.