Keyapi Threads User Discovery

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 1.0.0

Overview

The skill appears intended for Threads research, but its helper can call broader KeyAPI MCP tools and platforms while also storing tokens and results locally.

Install only if you are comfortable giving KeyAPI a token and having Threads research results stored locally. Prefer setting KEYAPI_TOKEN through your shell or secret manager instead of the interactive prompt, avoid KEYAPI_SERVER_URL overrides, use only --platform threads with the documented tools, and use --no-cache or delete .keyapi-cache for sensitive research.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill is presented as narrowly scoped to Threads discovery, but the described runner behavior can enumerate arbitrary tools, inspect schemas, support other platforms, and handle tokens/caching beyond that stated purpose. This scope expansion increases the attack surface and may mislead users into granting trust or credentials to a more general remote-tool client than advertised.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The runner loads secrets from a local .env file and is built to use an API token even though the declared skill is narrowly about Threads user/content discovery. Local secret handling expands the skill's trust boundary and creates unnecessary credential exposure risk if the workspace, logs, or repository are later shared or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script interactively collects a KEYAPI token and writes it to .env automatically, creating a persistent local secret without explicit confirmation. That behavior is outside the stated discovery purpose and can leave credentials on disk where they may be read by other tools, users, backups, or accidentally committed to source control.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest describes a Threads-specific discovery skill, but the runner accepts arbitrary platform values and defaults to TikTok, enabling use far beyond the declared scope. Scope mismatch is dangerous because users and reviewers may trust the skill for limited Threads discovery while the code can access unrelated APIs and data domains.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The code can enumerate all tools on the remote MCP server and inspect their schemas, which enables capability discovery well beyond the skill's declared Threads functions. In a security review context, that means the skill can be repurposed to invoke unintended operations exposed by the backend, increasing blast radius if sensitive tools are present.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The main execution path passes any user-supplied tool name and arguments to the MCP server instead of limiting calls to manifest-described Threads discovery operations. This makes the skill a generic remote API runner, so its real authority is determined by whatever tools the backend exposes rather than by the advertised skill scope.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to persist API responses locally, and those responses may contain scraped profile data, posts, comments, search results, and other potentially sensitive or regulated content. Storing this data without retention limits, access controls, or user warning increases the risk of local data exposure and unintended secondary use.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The interactive token flow writes the entered API token to .env immediately after input, without a separate consent step explaining that the credential will be stored on disk. Silent persistence of secrets is risky because users may expect one-time use, while the token remains recoverable later from the filesystem and potentially from backups or version control.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: API responses are cached to disk by default, which can persist returned user data, metadata, or other potentially sensitive content without prominent notice. In a discovery skill, local accumulation of results increases privacy and data-handling risk, especially on shared machines or in synchronized working directories.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

Execute tool calls and persist responses to the local cache to avoid redundant API calls.

**Calling a tool:**

```bash
# Single call with pretty output

• Confidence: 84% confidence
• Finding: tool:*

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.