Security audit

mindgraph

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its diagram-generation purpose, but its setup docs tell users to paste an API token and account into chat, which is unsafe credential handling.

Review before installing. Use only a secure per-skill environment or secret configuration for MINDGRAPH_TOKEN and MINDGRAPH_ACCOUNT; do not paste live credentials into chat. If credentials were already pasted into a conversation, regenerate the MindGraph token and remove the affected transcript where possible.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:50
Finding: Documentation Encourages Users to Submit API Credentials Through Chat
Content: View full analysis
Remediation: View remediation
Never paste `MINDGRAPH_TOKEN` or `MINDGRAPH_ACCOUNT` into chat. Chat content may be retained in transcripts, telemetry, or diagnostic logs. 5. Redact authentication headers, account identifiers, and signed image URLs from application, proxy, and tool logs. 6. Treat signed PNG URLs as temporary bearer capabilities. Restrict them to the configured HTTPS MindGraph origin, use short expiration periods, avoid displaying them as plain text, and do not persist them in logs. 7. If credentials have already been entered into chat: - Regenerate the API token immediately. - Delete the affected conversation where supported. - Clear relevant client and diagnostic logs. - Review server-side token audit logs for unexpected paths or client sources. 8. Consider using separately scoped, revocable API tokens with only the diagram operations required by this Skill. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly tells users they can place MINDGRAPH_BASE_URL, MINDGRAPH_ACCOUNT, and MINDGRAPH_TOKEN in the chat for testing. Sending secrets through a conversational interface creates a direct disclosure path to the model runtime, logs, transcripts, integrations, and potentially other tools, and the only caution given is not to echo the token back, which does not mitigate secret exposure.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This documentation normalizes giving account credentials and API tokens directly to the assistant in natural language, creating an easy social and technical path for sensitive data disclosure. In the context of an agent skill, that is especially dangerous because the model may process, retain, summarize, forward, or accidentally reveal those values across tool calls and conversation history.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown instructs users to navigate via Chinese-only menu labels ("账户信息" and "生成 Token") even though the skill otherwise targets general use and does not state that the product is Chinese-only or region-specific. This is a natural-language locale policy issue because it assumes a specific interface language without user opt-in or an explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction string includes Chinese UI text ("账户信息 → API Token") as the required navigation path, which assumes a specific product language/locale. This can violate language/locale policy because the file does not offer an alternative language path or indicate that the locale-specific instruction is optional.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.