T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/voice2need/adapters/discord.py:190- Finding
Configurable Discord Export Executable Receives the Discord Token and Full Parent Environment
- Content
View full analysis
- Remediation
View remediation
Security audit
voice2need
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate research tool, but live Discord export gives a sensitive token and the full environment to a configurable external program, which needs careful review before use.
Use the offline demo or existing Discord exports when possible. For live runs, approve only specific sources and budgets, keep raw run directories private, use only trusted API tokens, and for Discord verify the exporter path yourself and run with a minimal environment so unrelated secrets are not exposed.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/voice2need/adapters/apify.py:57- Finding
Unpinned Third-Party Apify Actors Can Change After Skill Review
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Undeclared outbound HTTPS, credential retrieval from environment variables, and persistent local storage of raw data/checkpoints materially change the security profile of the skill. These hidden infrastructure behaviors can leak sensitive data, create compliance issues, and leave durable artifacts on disk without informed approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Undeclared outbound HTTPS, credential retrieval from environment variables, and persistent local storage of raw data/checkpoints materially change the security profile of the skill. These hidden infrastructure behaviors can leak sensitive data, create compliance issues, and leave durable artifacts on disk without informed approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared outbound HTTPS, credential retrieval from environment variables, and persistent local storage of raw data/checkpoints materially change the security profile of the skill. These hidden infrastructure behaviors can leak sensitive data, create compliance issues, and leave durable artifacts on disk without informed approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Undeclared outbound HTTPS, credential retrieval from environment variables, and persistent local storage of raw data/checkpoints materially change the security profile of the skill. These hidden infrastructure behaviors can leak sensitive data, create compliance issues, and leave durable artifacts on disk without informed approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared outbound HTTPS, credential retrieval from environment variables, and persistent local storage of raw data/checkpoints materially change the security profile of the skill. These hidden infrastructure behaviors can leak sensitive data, create compliance issues, and leave durable artifacts on disk without informed approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Undeclared outbound HTTPS, credential retrieval from environment variables, and persistent local storage of raw data/checkpoints materially change the security profile of the skill. These hidden infrastructure behaviors can leak sensitive data, create compliance issues, and leave durable artifacts on disk without informed approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Undeclared outbound HTTPS, credential retrieval from environment variables, and persistent local storage of raw data/checkpoints materially change the security profile of the skill. These hidden infrastructure behaviors can leak sensitive data, create compliance issues, and leave durable artifacts on disk without informed approval.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md 4. Write the findings JSON using [the findings format](references/findings-format.md). Keep each claim beside an exact source snippet and its evidence ID. Keep authors, projects, payers, personal percentages, and historical context separate. 5. Answer all fourteen research questions or state the specific remaining gap. Seek counterexamples and check underrepresented platforms, recent evidence, direct competitors, and ordinary discussions that keyword searches could miss. 6. Independently review the conclusions that change a decision. Check their quotations, authors, time, context, money, action status, and strongest counterexample. Use a separate reviewer when available; otherwise label a separate self-review honestly. 7. Validate, render, and read the final report. Fix structural failures and semantic errors. Trace every important finding to its destination or a reason for deferral; do not judge completion by record counts alone. For a new domain or a changed analysis prompt, use the invented cases in [semantic evaluation](references/semantic-evaluation.md). Offline unit tests check identities and arithmetic; they cannot certify that an AI understood a conversation.
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The code launches an external process with the entire parent environment plus
DISCORD_TOKEN, which can expose unrelated secrets to the child process and any of its descendants. In this skill context, the child is a user-configurable exporter command, so a malicious or substituted executable could read and exfiltrate all inherited environment variables, not just the Discord token.- Content
python "--markdown", "false", "--respect-rate-limits", "true"] stdout, stderr, code, status = b"", b"", None, "complete" try: result = subprocess.run(args, env={**os.environ, "DISCORD_TOKEN": token}, capture_output=True, timeout=timeout, check=False) stdout, stderr, code = result.stdout, result.stderr, result.returncode except subprocess.TimeoutExpired as exc:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises operational behaviors that imply access to network, filesystem, shell, and environment-backed credentials, yet it declares no explicit tool or permission scope. This creates a confused-deputy risk where a host may grant broader capabilities than users expect, enabling unauthorized data collection, token use, local persistence, or subprocess execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The example configuration sets
"language": "en", which presents English as the default analysis language in the natural-language reference. Because this file does not indicate that users may choose another language or that English is required for a justified region-specific purpose, it can violate the language/locale policy for skills.- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 60% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
md | `retention_days` | Positive integer, default 30; records a retention review date, not automatic deletion | | `limits.max_requests` | Nonnegative Session HTTP-request cap, default 100; failures also consume attempts | | `limits.max_units` | Optional nonnegative internal resource-unit cap; `null` leaves it unset; not a dollar cap or a complete provider quota model | | `analysis` | Packet subject-record/character limits; optional `evidence_ids` selects candidate IDs; context/long records can exceed limits without truncation | | `questions` | Optional question wording by Q01–Q14, or an array of `{"id":"Q08","question":"..."}`; all fourteen slots remain | Each job requires a unique `id` of 1–80 letters, digits, `_` or `-`, and `platform` in `reddit`, `youtube`, `x`, `discord`. Specify a mode explicitly. A changed collection scope uses a new config and new run directory; resuming reuses the unchanged config and run directory. Prior source/spend authorization still applies within its stated boundary.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python from voice2need.runtime import SourceError, require_env API = "https://api.apify.com/v2" TERMINAL = {"SUCCEEDED", "FAILED", "ABORTED", "TIMED-OUT"} ACTIVE = {"READY", "RUNNING", "TIMING-OUT", "ABORTING"}
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "--markdown", "false", "--respect-rate-limits", "true"] stdout, stderr, code, status = b"", b"", None, "complete" try: result = subprocess.run(args, env={**os.environ, "DISCORD_TOKEN": token}, capture_output=True, timeout=timeout, check=False) stdout, stderr, code = result.stdout, result.stderr, result.returncode except subprocess.TimeoutExpired as exc:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python from voice2need.runtime import SourceError, require_env from .apify import positive_int API = "https://api.x.com/2/tweets" FIELDS = "id,text,created_at,author_id,conversation_id,referenced_tweets,public_metrics,lang,note_tweet"
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The module documentation states "bounded, opt-in HTTP," which implies network access is gated by explicit live enablement. However, the request path only blocks networking when both live is false and transport is None, so any caller-provided transport can execute requests without --live, contradicting the stated opt-in behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The config sets "language": "en", which is a natural-language locale constraint. In this file there is no indication that the user can choose another language or that the English-only setting is required for a documented region-specific purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The config hard-codes the language as "en", which is a natural-language locale constraint. Under the policy, locale restrictions should either offer user choice or be clearly documented and justified as region-specific; this file does neither.
- Content