Poe Chat

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:16 PM UTC
• Version: 1.0.0

Overview

This skill is a Poe chat helper whose network calls, API key use, model listing, and optional file uploads fit its stated purpose, though users should treat uploaded files and API keys carefully.

Install only if you are comfortable sending prompts and any --file attachments to Poe. Prefer POE_API_KEY over --api-key so the key is not stored in shell history, avoid uploading sensitive documents unless necessary, and consider pinning dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

requests== ``` 2. Generate and retain a lock file that includes resolved transitive dependencies. 3. Record cryptographic hashes and install with `pip --require-hashes`. 4. Use a controlled package index or approved dependency mirror where practical. 5. Add automated vulnerability and dependency-update scanning. 6. Review dependency changes before updating pins, including transitive dependency changes and package provenance. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/poe_client.py:59

Finding

Poe API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tainted flow: 'api_key' from os.getenv (line 115, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/list_models.py (reported line 48)May include surrounding context.

python

def _fetch_models_from_api(api_key: Optional[str]) -> List[ModelInfo]:
    response = requests.get(
        MODEL_LIST_URL,
        headers=_build_headers(api_key),
        timeout=30,

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill promises an @trigger-driven experience with automatic model selection, but the described invocation requires the user to pass --model-id explicitly through a CLI. This inconsistency can cause unsafe automation assumptions, where higher-level systems believe the skill will constrain behavior based on trigger words while the actual interface accepts direct model identifiers and bypasses those promised controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill promises an @trigger-driven experience with automatic model selection, but the described invocation requires the user to pass --model-id explicitly through a CLI. This inconsistency can cause unsafe automation assumptions, where higher-level systems believe the skill will constrain behavior based on trigger words while the actual interface accepts direct model identifiers and bypasses those promised controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill promises an @trigger-driven experience with automatic model selection, but the described invocation requires the user to pass --model-id explicitly through a CLI. This inconsistency can cause unsafe automation assumptions, where higher-level systems believe the skill will constrain behavior based on trigger words while the actual interface accepts direct model identifiers and bypasses those promised controls.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Allowing any '@xxx' token as a trigger creates a very ambiguous activation condition and broadens the chance of accidental invocation. In a skill that can perform network calls and upload files, such ambiguity materially increases the risk of unintentional external data transmission or misuse through crafted prompts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documentation describes capabilities that involve environment variables, local file access, writing cache files, and outbound network calls, but it declares no explicit tool scope or permission boundaries. This creates unnecessary ambiguity about what the skill may access and makes accidental overreach or unsafe execution more likely, especially when files and API keys are involved.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation description is broad enough that the skill could be invoked in many contexts whenever a matching token appears, without clear boundaries on user intent. Ambiguous triggering is risky because it may send prompts or files to an external service unexpectedly, especially in mixed conversations where @tokens may appear incidentally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises local file upload support but does not clearly warn users that selected files will be transmitted to an external Poe service. This is a privacy and data-handling vulnerability because users may upload sensitive local documents without informed consent or understanding of where the data is sent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The behavior section states that files are uploaded through an API but omits any privacy or external-transmission notice. When paired with broad triggers and unclear activation, this increases the chance of silent leakage of local data to a remote provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list_models.py (reported line 14)May include surrounding context.

python

import requests


MODEL_LIST_URL = "https://api.poe.com/v1/models"
MODEL_CACHE_TTL_SECONDS = 60 * 60

Tainted flow: 'payload' from os.getenv (line 119, credential/environment) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/list_models.py (reported line 121)May include surrounding context.

python

output = _build_output(models, args.full)
    payload = json.dumps(output, ensure_ascii=False, indent=2)

    out_path.write_text(payload, encoding="utf-8")
    print(payload)
    return 0

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script transmits the user message and any uploaded files to an external third-party service (Poe) without an explicit user-facing warning at runtime about off-host data transfer. Because the skill supports file upload and arbitrary prompts, users may unintentionally send sensitive local content or secrets to an external model provider, which is more concerning in an agent-skill context where tool invocation may feel implicit.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes a chat skill that routes prompts to Poe-backed models and supports file upload. Accessing credentials from the process environment is an additional capability not mentioned in that purpose statement, even though it is used to enable the remote API call.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency fastapi-poe is unpinned, so installs may pull different versions over time, including releases with breaking changes or newly introduced vulnerabilities. In a skill that brokers prompts/files to external model APIs, dependency drift increases supply-chain risk and makes builds non-reproducible.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

fastapi-poe
requests

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The requests package is unpinned, which allows installation of any available version and prevents assurance that a safe, tested release is used. Because this skill supports file upload and likely performs outbound HTTP calls, an unsafe or changed requests version could affect transport security, credential handling, or runtime behavior.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

fastapi-poe
requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The manifest references requests without a version, and multiple known advisories exist for some requests releases, so it is impossible to verify whether deployment will use a vulnerable version. In this skill's context, which likely makes HTTP requests and may handle uploaded files or credentials when interacting with Poe/model services, a vulnerable requests release could expose secrets or weaken request verification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.