T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:58- Finding
Plaintext Social-Media Credential Storage Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Social Media Manager
Security checks for vulnerabilities and agentic risk
Overview
The skill does not show theft or system persistence, but it asks for plaintext social-media credentials and presents mock social-platform actions as real capabilities.
Review carefully before installing. Do not place real social-media passwords, cookies, API keys, or access tokens in TOOLS.md. Treat posting, comment, and analytics functions as unverified or mock behavior unless the publisher documents real integrations and safe secret handling. Use test accounts, manually review any public replies or posts, and rotate any credentials already stored in plaintext.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T07 · Tool Hijacking and Spoofing
Warning
- Location
src/platform-adapter.js:99- Finding
Simulated Platform Adapters Spoof Successful Operations and Genuine Platform Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README instructs users to place usernames, passwords, cookies, and API tokens directly into TOOLS.md, which is typically a plaintext documentation/config file that may be version-controlled, shared, or exposed to other tools. Storing secrets this way greatly increases the risk of credential leakage, account takeover, and unauthorized posting or data access across linked social media accounts.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README claims that data stays on-device, yet the skill’s core functionality requires posting to third-party social media platforms, fetching comments, and analyzing account data. This is misleading because user content, account activity, and credentials necessarily interact with external services, which can cause users to make unsafe trust decisions based on a false privacy assurance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language content of the skill documentation is presented only in Chinese, and there is no indication that the skill is intentionally limited to a Chinese-speaking region or that alternate language support is available. This can violate language/locale policy when a specific language is effectively forced without user opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill promotes automatic replies and bulk interaction on live social media accounts without warning that these actions can publish public content, trigger rate limits, violate platform policies, or damage account reputation. In this context, automation acts on real external accounts, so omission of operational safeguards increases the chance of harmful or unintended actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill advertises automatic replies and interactions on external social-media accounts but does not warn about the risks of unsupervised posting, spam, accidental policy violations, or reputational harm. Because these actions affect third-party platforms and public-facing accounts, lack of guardrails can lead to unintended content publication or abusive automation behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to place live social-media credentials, including cookies and passwords, directly into TOOLS.md without any warning about secure secret handling. This creates a significant risk of credential leakage through source control, logs, prompt exposure, or unintended agent/tool access, which could lead to full compromise of external social-media accounts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains user-facing console output and comments primarily in Chinese, including the demo banner and all interaction text. Because the skill presents a fixed language/locale without any opt-in or alternative, it may violate language/locale policy for users expecting language choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README documents automated posting, comment retrieval, analytics access, and storage of platform credentials, but it does not warn users about account-impacting actions, privacy implications, rate limits, or platform policy/compliance risks. In an agent skill context, this omission is dangerous because operators may enable automation against real social accounts without understanding that the tool can act on their behalf and process account data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code presents its description, help text, command guidance, and runtime messages exclusively in Chinese. That imposes a locale/language choice on all users with no apparent option to select another language, which matches the policy-violation category for forced language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Natural-language strings, comments, templates, recommendations, and generated replies throughout the file are written in Chinese, which effectively constrains the skill's interaction language. The file does not offer any language selection, opt-in, or explanation that this is a region-specific skill, so this is a language/locale policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The top-level comment describes the file as a "platform adapter" supporting multi-platform integration, which implies actual integration behavior with external platforms. However, every adapter method simply returns fabricated success objects, comments, and analytics without calling any platform APIs or performing integration logic, creating a direct contradiction between the documentation and the implementation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code includes natural-language instructions and outputs in Chinese, such as the file description and several platform messages, while other parts are in English. Because the skill does not state that it is region-specific or provide a user language/locale option, it may violate a language/locale policy requiring opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions and headings are presented in Chinese, but the file does not indicate that the skill is region-specific or offer a language/locale choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern unless clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest presents key user-facing feature and changelog text in Chinese while other user-facing fields such as name and description are in English. This creates an implicit language constraint or inconsistent locale experience without stating whether the skill is intended only for Chinese-speaking users or offering any language/locale choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. Presenting the skill documentation solely in Chinese can effectively force a specific language without stating that the skill is region-specific or offering an alternative language option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains natural-language strings in Chinese for its title/commentary, and the rest of the file continues using Chinese-only console output and test names. Under the policy rule for language or locale constraints, forcing a single language without user opt-in can be a natural-language policy violation when no choice or justification is provided.
- Content
Static analysis
No suspicious patterns detected.