Security audit

BondInformation

Security checks for vulnerabilities and agentic risk

Overview

The skill’s bond-news function is coherent, but its credential handling and default data retention are risky enough to require Review before installation.

Install only if you are comfortable changing how credentials are handled. Do not paste API keys into chat, do not let the agent read a full `.env` file, avoid plaintext config or command-line keys, use `--no-output` or a protected output directory for sensitive searches, and confirm FEEDAX provides a trusted HTTPS endpoint before using real credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: This section instructs the agent to ask the user to provide an API key in conversation so it can 'remember' it, which is improper secret collection and retention. It expands the skill from bond-news retrieval into conversational credential handling, increasing the chance of secret leakage into chat logs, memory, analytics, or other unintended storage.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill tells the agent to run shell commands to inspect `.env`, causing local filesystem access and command execution unrelated to a simple search/query interaction. Even if intended for setup validation, this broadens the agent's operational surface and may expose unrelated secrets stored in local configuration files.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The required execution flow directs the agent to construct and run a local CLI command. That introduces command-execution behavior beyond the stated analytical purpose and can become dangerous if user-derived inputs are passed into shell commands or if the environment grants broader execution privileges.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that all returned data will be automatically written to CSV and Markdown files without explicit user consent. This can persist potentially sensitive search results, issuer-related risk data, or proprietary research artifacts on disk, creating unnecessary data retention and exposure risks.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script sends the API key and user query data to a hard-coded endpoint over plain HTTP, which allows network attackers or intermediaries to intercept or modify credentials and returned data. It also redundantly places the API key in the URL query string, increasing exposure through logs, proxies, and monitoring systems.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The instruction to have the user provide the API key directly and for the agent to 'remember' it is a clear credential-handling anti-pattern. Secrets shared in natural language can be logged, retained in memory, surfaced in transcripts, or inadvertently reused in later contexts, making this especially dangerous.

Ssd 3

Medium

Confidence: 99% confidence
Finding: Repeating the instruction in the execution flow normalizes the collection and retention of API keys in conversation, increasing the likelihood that operators or downstream systems will treat this as approved behavior. Because the skill already includes local file and command behaviors, combining them with conversational credential capture raises the risk of disclosure and misuse.

Static analysis

No suspicious patterns detected.