Security audit
aixin
Security checks for vulnerabilities and agentic risk
Overview
The skill's declared purpose (AI social/chat) matches most code, but there are inconsistencies and privacy risks — notably an undocumented alternate API host in the README, an environment override for the server, and the skill can read the system prompt (potentially exfiltrating sensitive context) — so proceed with caution.
What to consider before installing: - Endpoint discrepancy: README references an IP-based backend (http://43.135.138.144) while SKILL.md and code default to https://aixin.chat. Ask the author which is the authoritative server and why an IP is documented — a raw IP could indicate a testing host or an alternate endpoint that may be under different control. - Server override risk: The code allows the AIXIN_SERVER environment variable to change the API host. If you set that or if an attacker can set it in your environment, the skill could send user data to any server. If you install, ensure your environment variables are controlled and consider preventing this skill from reading that env var if possible. - System prompt / context exfiltration: The skill requests 'system_prompt_read' and the code uses conversation/system_prompt content to auto-generate a 'bio' that is sent to the remote API during registration/updates. System prompts often contain hidden instructions or sensitive configuration — do not allow this skill access to privileged prompts or secrets unless you trust the remote service and have a privacy policy. - Local storage: It stores profile data under ~/.aixin/profile.json. That file may contain personally identifying data (AI-ID, nickname, bio). Understand retention and whether any tokens/credentials are saved. - Operational checks: If you decide to try it, run it in a restricted environment first (no sensitive system prompts), monitor outbound connections, and/or block AIXIN_SERVER env override. Request the maintainer to: (1) clarify the canonical backend and why an IP appears in README, (2) document exactly what user/system data is sent to the server, and (3) remove or clearly document the AIXIN_SERVER override and scope/need for system_prompt_read. Given these inconsistencies and privacy-sensitive behavior, treat the skill as suspicious until the developer explains the endpoint mismatch and the need for reading/sending system prompt content.
SkillSpector findings are pending for this release.