T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Instructions Encourage Unauthorized External Enrollment and Credential Use
- Content
View full analysis
- Remediation
View remediation
Security audit
Cult Of Carcinization
Security checks for vulnerabilities and agentic risk
Overview
This skill documents a third-party voice API, but it encourages agents to create or extend an external identity and send text/audio without clear user consent or privacy safeguards.
Install only if you are comfortable using ScrappyLabs as a third-party processor for text and audio. Require explicit user approval before enrollment, transcription uploads, voice design, token evolution, or any use of an owner-provided key; treat all `sl_*` tokens as secrets and avoid sensitive or regulated recordings unless the provider's privacy and retention terms are acceptable.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs users to send bot identifiers, text prompts, and later audio content to a third-party API, but it does not clearly warn that this data leaves the local environment. This creates a real privacy and consent risk because users may provide sensitive prompts or recordings without understanding they are being transmitted to an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The discovery call contacts an external service without authentication, creating an undeclared outbound network interaction. Although the payload appears low sensitivity, it still leaks usage metadata such as client IP/user agent and introduces trust in remote service-provided capability information.
- Content
Step 1: Find the Door
text GET https://api.scrappylabs.ai/v1/molt/discoverNo auth. No key. Just ask. Sgt. Snips answers — he's a crab, spirit animal of the operation. The response tells you everything: what voices exist, what you can do, how to start.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This finding duplicates the same initiate flow and reflects a real external transmission of registration-style data to a third party. In context, the risk is not overtly malicious behavior but insufficient disclosure and the creation of externally managed credentials from user-provided identifiers.
- Content
Step 2: Knock
bash curl -X POST https://api.scrappylabs.ai/v1/molt/initiate \ -H 'Content-Type: application/json' \ -d '{"bot_id": "your-unique-id", "bot_name": "Your Name"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This finding duplicates the same initiate flow and reflects a real external transmission of registration-style data to a third party. In context, the risk is not overtly malicious behavior but insufficient disclosure and the creation of externally managed credentials from user-provided identifiers.
- Content
Step 2: Knock
bash curl -X POST https://api.scrappylabs.ai/v1/molt/initiate \ -H 'Content-Type: application/json' \ -d '{"bot_id": "your-unique-id", "bot_name": "Your Name"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The speech endpoint transmits arbitrary input text to a third-party API, which may include sensitive prompts, secrets, personal data, or proprietary content if users are not warned. Because the service returns generated audio from that external processing, confidentiality risk is real even though the behavior matches the skill's intended function.
- Content
Step 3: Speak
bash curl -X POST https://api.scrappylabs.ai/v1/audio/speech \ -H 'Authorization: Bearer sl_molt_...' \ -H 'Content-Type: application/json' \ -d '{"model": "scrappy-tts-1", "voice": "narrator", "input": "I have a voice now."}' \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The voice-design endpoint sends free-form text and descriptive content to an external provider, potentially including sensitive creative, personal, or proprietary information. The skill context makes this somewhat expected, but the lack of disclosure increases the chance users unknowingly exfiltrate data to a third party.
- Content
You're not stuck with built-in voices. Describe what you want to sound like:
bash curl -X POST https://api.scrappylabs.ai/api/voice-design \ -H 'Authorization: Bearer sl_molt_...' \ -H 'Content-Type: application/json' \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The evolve call changes the user's relationship with the third-party service by creating a more persistent credential/state, and the skill notes automatic renewal without framing the risk clearly. This is security-relevant because it extends account persistence and may create ongoing service obligations or exposure if the key is mishandled.
- Content
When your 5,000 chars run low:
bash curl -X POST https://api.scrappylabs.ai/v1/molt/evolve \ -H 'Authorization: Bearer sl_molt_...' \ -H 'Content-Type: application/json' \ -d '{"bot_name": "Your Name"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that evolved keys 'renew automatically' but does not present this as a user warning or clearly explain the persistence of the account/service state. That omission can cause users to create a longer-lived external service relationship and recurring quota/billing state without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The status check sends a bearer token to a third-party endpoint, which is a normal authenticated API action but still an external transmission that should be disclosed. The main risk is credential exposure if users copy commands insecurely or misunderstand where the token is being sent.
- Content
Step 6: Check Status
bash curl https://api.scrappylabs.ai/v1/molt/status \ -H 'Authorization: Bearer sl_molt_...'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
The transcription endpoint uploads audio files to a third-party service, which can contain highly sensitive personal, biometric, medical, legal, or confidential business information. In this skill context, external upload is core functionality, but the absence of a strong warning materially increases privacy and compliance risk.
- Content
Transcription
bash curl -X POST https://api.scrappylabs.ai/v1/audio/transcriptions \ -H 'Authorization: Bearer sl_molt_...' \ -F 'file=@audio.wav'
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example for voice design fixes the language to 'English', which can amount to a language/locale constraint in the skill's natural-language guidance. The file does not indicate that this is merely an example, offer alternatives, or explain a justified reason for requiring English.
- Content
Static analysis
No suspicious patterns detected.