I'm Pretty Amazing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 0.2.4

Overview

This skill is a coherent service integration, but it asks agents to store reusable account session tokens in plaintext and handle them in ways that could expose the account.

Review this before installing if the account matters to you. Avoid opting into saved session tokens unless TOOLS.md is protected from other users, extensions, backups, and future agent sessions; prefer session-only login or a proper credential store, and clear/revoke saved tokens if exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:12
• Finding: Reusable Session Tokens Persisted in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12–21, 36–37, and 61–77 **Vulnerability Type**: Plaintext storage of reusable authentication credentials **Risk Level**: High The Skill directs the agent to persist access and refresh tokens in `TOOLS.md`. Although persistence requires user consent and the documentation warns that the values are stored in plaintext, these tokens remain bearer credentials that grant access to the user's account. ### Vulnerable Code ```markdown On first use, check TOOLS.md for an `### I'm Pretty Amazing` section. Persisted auth data should include cookie values and JWT expiry metadata so auth can be reused until expiration: ```markdown ### I'm Pretty Amazing - **Username:** their-username (optional) - **Access Token Cookie:** eyJhbGciOi... - **Refresh Token Cookie:** eyJhbGciOi... (optional but recommended) - **Access Token Expires At (UTC):** 2026-03-21T03:04:46Z ``` ``` ```markdown After successful login, ask the user: "Want me to save your session tokens so you stay logged in for future requests? They'll be stored in plaintext in TOOLS.md and expire automatically. Decline if others can access your TOOLS.md." If they agree, persist `access_token`, `refresh_token` (if present), and access-token expiry in TOOLS.md. ``` ```bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" ACCESS_TOKEN="<Access Token Cookie from TOOLS.md>" REFRESH_TOKEN="<Refresh Token Cookie from TOOLS.md>" cat > "$IPA_COOKIE_FILE" <<EOF # Netscape HTTP Cookie File .imprettyamazing.com TRUE / TRUE 0 access_token $ACCESS_TOKEN .imprettyamazing.com TRUE / TRUE 0 refresh_token $REFRESH_TOKEN EOF ``` ### Technical Analysis Access and refresh tokens are bearer credentials: possession of a valid token is generally sufficient to act as the authenticated user. Placing these values in a general-purpose plaintext Markdown file exposes them to any local user, process, extension, backup system, or later agent session that can read that file. The ...[truncated 1621 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store persistent tokens in an operating-system credential store or dedicated secrets manager rather than `TOOLS.md`. 2. Keep only non-sensitive metadata, such as username and expiration time, in general agent context files. 3. If secure storage is unavailable, disable cross-session token persistence and require reauthentication in each session. 4. Prefer short-lived, narrowly scoped tokens where the API supports them. 5. Provide explicit token revocation when the user logs out or disables persistence. 6. Restrict any unavoidable credential file to the owning user with mode `0600`, exclude it from source control and backups, and avoid loading its contents into unrelated agent context. 7. Rotate or revoke any token suspected of having been exposed through an existing plaintext file. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:85
• Finding: Passwords and Session Tokens Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 85–90 and 135–140 **Vulnerability Type**: Sensitive information exposure through process arguments and execution logs **Risk Level**: Medium The documented authentication and cookie examples place passwords and bearer tokens directly into `curl` command arguments. ### Vulnerable Code ```bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE" ``` ```bash curl -s https://api.imprettyamazing.com/wins/my-wins \ -H "Cookie: access_token=<Access Token Cookie from TOOLS.md>; refresh_token=<Refresh Token Cookie from TOOLS.md>" ``` ### Technical Analysis Arguments supplied with `-d` and `-H` become part of the `curl` process command line. Depending on the operating system and execution environment, command arguments may be observable through: - Process inspection facilities such as `/proc` or process-listing utilities. - Shell history if commands are entered interactively. - Agent tool-call records and execution telemetry. - Debug traces, audit logs, or error reports. - Command wrappers that record complete invocations. The login example exposes both the email address and password. The explicit `Cookie` header example exposes reusable access and refresh tokens. HTTPS protects the network transport but does not prevent local disclosure before the request is transmitted. ### Attack Path 1. The agent substitutes the user's actual email, password, or session tokens into the documented command. 2. The command is executed with those values present in its argument vector. 3. A local observer, command wrapper, telemetry collector, or log reader captures the command arguments. 4. The attacker extracts the password or bearer tokens. 5. The attacker logs in with the password or replays the captured cookies against the service API. 6. T ...[truncated 655 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not interpolate passwords or bearer tokens directly into command-line arguments. 2. Use a client library that accepts sensitive values in memory without exposing them in the process argument vector. 3. If `curl` must be used, supply the request body or configuration through a permission-restricted temporary file or protected standard input. 4. Avoid explicit cookie headers containing token values; use a protected cookie jar with `curl -b`. 5. Ensure agent execution infrastructure redacts credentials from tool calls, traces, logs, and error messages. 6. Disable shell tracing around authentication operations and prevent sensitive commands from entering shell history. 7. Delete protected temporary request files immediately after use and register cleanup handlers for abnormal termination. 8. Rotate any password or token found in process telemetry or execution logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66
• Finding: Predictable and Insufficiently Protected Temporary Cookie Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–78, 85–100, and 255 **Vulnerability Type**: Unsafe temporary-file creation and incomplete credential cleanup **Risk Level**: Medium The Skill uses a process-ID-based filename under the shared `/tmp` directory for cookie storage. It does not explicitly set restrictive permissions, create the file atomically, or register automatic cleanup. ### Vulnerable Code ```bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" ACCESS_TOKEN="<Access Token Cookie from TOOLS.md>" REFRESH_TOKEN="<Refresh Token Cookie from TOOLS.md>" cat > "$IPA_COOKIE_FILE" <<EOF # Netscape HTTP Cookie File .imprettyamazing.com TRUE / TRUE 0 access_token $ACCESS_TOKEN .imprettyamazing.com TRUE / TRUE 0 refresh_token $REFRESH_TOKEN EOF ``` ```bash IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt" curl -s -X POST https://api.imprettyamazing.com/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"EMAIL","password":"PASSWORD"}' \ -c "$IPA_COOKIE_FILE" ``` ```markdown If the user asks to log out or clear their session, remove the `### I'm Pretty Amazing` section from TOOLS.md and delete any `/tmp/ipa-cookies-*.txt` files. ``` ### Technical Analysis The filename `/tmp/ipa-cookies-$$.txt` is derived from the process ID and is therefore predictable. The shell redirection uses `cat >` rather than an atomic secure-file creation primitive. In a shared temporary directory, a local attacker may be able to anticipate the path and pre-position a file or symbolic link before the Skill writes the credentials. The documentation does not set `umask 077` or enforce mode `0600`. Resulting permissions therefore depend on the ambient process configuration and the behavior of the tools creating or replacing the cookie jar. Cleanup occurs only when the user explicitly asks to log out or clear the session. There is no `EXIT`, signal, or failure trap, so cookie files can survive completed, interrupted, or failed operations. The wild ...[truncated 1713 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the cookie jar atomically with `mktemp`, for example: ```bash umask 077 IPA_COOKIE_FILE="$(mktemp "${TMPDIR:-/tmp}/ipa-cookies.XXXXXXXX")" || exit 1 chmod 600 "$IPA_COOKIE_FILE" ``` 2. Register deterministic cleanup immediately after creation: ```bash cleanup() { rm -f -- "$IPA_COOKIE_FILE" } trap cleanup EXIT HUP INT TERM ``` 3. Verify that the file is a regular file, is owned by the current user, and is not a symbolic link before writing sensitive data. 4. Prefer a private runtime directory owned by the current user over a shared global temporary directory. 5. Delete only the exact cookie file created by the current session; do not use `/tmp/ipa-cookies-*.txt` wildcard cleanup. 6. Ensure every normal, error, and signal-driven exit path removes the cookie jar. 7. Avoid reconstructing cookie files from plaintext persistent storage where possible; retrieve tokens directly from a secure credential store. 8. Revoke tokens if an expected cookie file is missing, has unexpected ownership, or shows evidence of unauthorized access. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Credential Access

High

• Category: Privilege Escalation

Content

```markdown
### I'm Pretty Amazing
- **Username:** their-username (optional)
- **Access Token Cookie:** eyJhbGciOi...
- **Refresh Token Cookie:** eyJhbGciOi... (optional but recommended)
- **Access Token Expires At (UTC):** 2026-03-21T03:04:46Z
```

• Confidence: 99% confidence
• Finding: The skill explicitly instructs persistence of access and refresh token cookie values in TOOLS.md, a plaintext file. Session tokens function as bearer credentials, so anyone with access to that file could replay them to impersonate the user and access or modify their account.

Credential Access

High

• Category: Privilege Escalation

Content

- **Username:** their-username (optional)
- **Access Token Cookie:** eyJhbGciOi...
- **Refresh Token Cookie:** eyJhbGciOi... (optional but recommended)
- **Access Token Expires At (UTC):** 2026-03-21T03:04:46Z
```

Token handling:

• Confidence: 99% confidence
• Finding: The token-handling section normalizes storing access tokens in TOOLS.md while merely warning not to print them. The core issue is not display but retention of reusable authentication material in plaintext, which materially increases account takeover risk.

Credential Access

High

• Category: Privilege Escalation

Content

For cookie-auth endpoints, follow these steps:

**Step 0 — Reuse persisted auth if still valid (preferred):**
1. Read persisted `Access Token Cookie` (and `Refresh Token Cookie` if available) from TOOLS.md.
2. Verify that `Access Token Cookie` is present and `Access Token Expires At (UTC)` is a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SSZ). If either is missing or malformed, continue to Step 1.
3. If `Access Token Expires At (UTC)` is in the future, rebuild a cookie jar from those values and use that jar for requests.
4. If expired, continue to Step 1.

• Confidence: 99% confidence
• Finding: The authentication flow directs the agent to read persisted access and refresh tokens from TOOLS.md for reuse. This creates a standing credential cache in a non-secret document, making theft or accidental disclosure of valid session material much more likely.

Credential Access

High

• Category: Privilege Escalation

Content

**Step 0 — Reuse persisted auth if still valid (preferred):**
1. Read persisted `Access Token Cookie` (and `Refresh Token Cookie` if available) from TOOLS.md.
2. Verify that `Access Token Cookie` is present and `Access Token Expires At (UTC)` is a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SSZ). If either is missing or malformed, continue to Step 1.
3. If `Access Token Expires At (UTC)` is in the future, rebuild a cookie jar from those values and use that jar for requests.
4. If expired, continue to Step 1.

• Confidence: 99% confidence
• Finding: This line continues the reuse model for plaintext-stored access tokens based on expiry metadata, effectively encouraging long-lived secret retention. Reusing stored session cookies without a secure vault increases the blast radius of any disclosure of TOOLS.md.

Credential Access

High

• Category: Privilege Escalation

Content

**Step 0 — Reuse persisted auth if still valid (preferred):**
1. Read persisted `Access Token Cookie` (and `Refresh Token Cookie` if available) from TOOLS.md.
2. Verify that `Access Token Cookie` is present and `Access Token Expires At (UTC)` is a valid ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SSZ). If either is missing or malformed, continue to Step 1.
3. If `Access Token Expires At (UTC)` is in the future, rebuild a cookie jar from those values and use that jar for requests.
4. If expired, continue to Step 1.

Canonical cookie-jar rebuild snippet (substitute persisted values from TOOLS.md):

• Confidence: 99% confidence
• Finding: The guidance to rebuild a cookie jar from token values in TOOLS.md demonstrates direct operational reuse of exposed bearer secrets. This makes the plaintext file a complete source for authenticated session reconstruction and account impersonation.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt"

ACCESS_TOKEN="<Access Token Cookie from TOOLS.md>"
REFRESH_TOKEN="<Refresh Token Cookie from TOOLS.md>"

cat > "$IPA_COOKIE_FILE" <<EOF

• Confidence: 99% confidence
• Finding: The snippet assigns access and refresh tokens from TOOLS.md into shell variables, further exposing secrets to process environments and shell history depending on execution context. Combined with plaintext storage, this materially increases credential leakage opportunities.

Credential Access

High

• Category: Privilege Escalation

Content

echo "$ACCESS_TOKEN_EXPIRES_AT_UTC"
```

Persist `ACCESS_TOKEN_EXPIRES_AT_UTC` as `Access Token Expires At (UTC)` in TOOLS.md.
Persist `ACCESS_TOKEN` as `Access Token Cookie` and `REFRESH_TOKEN` (if present) as `Refresh Token Cookie`.

**Step 2 — Make API calls (reuse the cookie file):**

• Confidence: 99% confidence
• Finding: This instruction explicitly tells the agent to persist token expiry metadata alongside access and refresh tokens in TOOLS.md. Expiry metadata makes the cached credentials easier to operationalize by signaling when stolen tokens remain valid.

Credential Access

High

• Category: Privilege Escalation

Content

```

Persist `ACCESS_TOKEN_EXPIRES_AT_UTC` as `Access Token Expires At (UTC)` in TOOLS.md.
Persist `ACCESS_TOKEN` as `Access Token Cookie` and `REFRESH_TOKEN` (if present) as `Refresh Token Cookie`.

**Step 2 — Make API calls (reuse the cookie file):**
```bash

• Confidence: 99% confidence
• Finding: Persisting both ACCESS_TOKEN and REFRESH_TOKEN in plaintext is especially dangerous because the refresh token can often mint new access tokens after expiry. That turns a local disclosure into potentially prolonged unauthorized access.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
curl -s https://api.imprettyamazing.com/wins/my-wins \
  -H "Cookie: access_token=<Access Token Cookie from TOOLS.md>; refresh_token=<Refresh Token Cookie from TOOLS.md>"
```

**Step 3 — Handle expired sessions:**

• Confidence: 98% confidence
• Finding: Embedding access and refresh tokens directly in a Cookie header exposes them in command text, which may be captured by logs, telemetry, shell history, debugging tools, or process listings. Because these are bearer-equivalent credentials, disclosure enables session hijacking.

Credential Access

High

• Category: Privilege Escalation

Content

If any call returns `{"statusCode": 401, ...}`:
1. Prompt again for email/password (session-only).
2. Call `POST /auth/login` again and overwrite the cookie file with `-c`.
3. Re-extract cookies from `IPA_COOKIE_FILE`. If session persistence was previously opted in, update `access_token`, `refresh_token`, and `Access Token Expires At (UTC)` in TOOLS.md.
4. Retry the failed call.

**Rules:**

• Confidence: 98% confidence
• Finding: The session-refresh logic again instructs updating plaintext-stored access and refresh tokens in TOOLS.md after re-login. This entrenches insecure credential persistence and ensures sensitive tokens remain continuously available for theft.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

All cookie-auth actions require `-b "$IPA_COOKIE_FILE"` after login. **The API reference at [references/api.md](references/api.md) is the complete endpoint documentation. Read it before using any endpoint not shown above.**

- **Update/delete wins**: `PATCH /wins/:id` (JSON body), `DELETE /wins/:id`
- **Comments**: `POST /wins/:id/comments` with `{"content": "..."}`, `GET /wins/:id/comments`
- **Likes**: `POST /wins/:id/like`, `DELETE /wins/:id/like` (toggle)
- **Follow/unfollow**: `POST /follows/:userId`, `DELETE /follows/:userId`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **Update/delete wins**: `PATCH /wins/:id` (JSON body), `DELETE /wins/:id`
- **Comments**: `POST /wins/:id/comments` with `{"content": "..."}`, `GET /wins/:id/comments`
- **Likes**: `POST /wins/:id/like`, `DELETE /wins/:id/like` (toggle)
- **Follow/unfollow**: `POST /follows/:userId`, `DELETE /follows/:userId`
- **Profile**: `PATCH /profile` (JSON: `username`, `bio` max 500 chars, `location`, `website`)
- **Avatar/cover**: `POST /profile/avatar` (multipart `avatar`), `POST /profile/cover` (multipart `cover`, keep file small)

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **Update/delete wins**: `PATCH /wins/:id` (JSON body), `DELETE /wins/:id`
- **Comments**: `POST /wins/:id/comments` with `{"content": "..."}`, `GET /wins/:id/comments`
- **Likes**: `POST /wins/:id/like`, `DELETE /wins/:id/like` (toggle)
- **Follow/unfollow**: `POST /follows/:userId`, `DELETE /follows/:userId`
- **Profile**: `PATCH /profile` (JSON: `username`, `bio` max 500 chars, `location`, `website`)
- **Avatar/cover**: `POST /profile/avatar` (multipart `avatar`), `POST /profile/cover` (multipart `cover`, keep file small)
- **Feedback**: `POST /feedback` with `{"category": "BUG|FEATURE_REQUEST|GENERAL", "message": "...", "pageUrl": "...", "pageContext": "..."}`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

Client guidance: you may persist cookie token values (`access_token`, optionally `refresh_token`) and reuse them until access-token expiry, then re-login.

Canonical expiry tracking: derive `Access Token Expires At (UTC)` from the `access_token` JWT `exp` claim and refresh auth when expired.

| Method | Endpoint | Description |
|--------|----------|-------------|

• Confidence: 98% confidence
• Finding: The document advises persisting `access_token` and optionally `refresh_token`, parsing JWT expiry, and reusing them for authentication. These tokens are bearer-equivalent session credentials; if an agent stores or handles them insecurely, anyone who obtains them can impersonate the user until expiry or refresh, making this especially dangerous in a skill that automates posting, profile changes, follows, and other authenticated actions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description includes proactive and broad triggers like posting wins, tracking achievements, and suggesting a win after something notable, which could match many ordinary conversations and cause the skill to activate unexpectedly. Because the skill can then solicit credentials and interact with an external service, accidental invocation increases privacy and consent risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt"

curl -s -X POST https://api.imprettyamazing.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"EMAIL","password":"PASSWORD"}' \
  -c "$IPA_COOKIE_FILE"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt"

curl -s -X POST https://api.imprettyamazing.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"EMAIL","password":"PASSWORD"}' \
  -c "$IPA_COOKIE_FILE"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt"

curl -s -X POST https://api.imprettyamazing.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"EMAIL","password":"PASSWORD"}' \
  -c "$IPA_COOKIE_FILE"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt"

curl -s -X POST https://api.imprettyamazing.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"EMAIL","password":"PASSWORD"}' \
  -c "$IPA_COOKIE_FILE"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt"

curl -s -X POST https://api.imprettyamazing.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"EMAIL","password":"PASSWORD"}' \
  -c "$IPA_COOKIE_FILE"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
IPA_COOKIE_FILE="/tmp/ipa-cookies-$$.txt"

curl -s -X POST https://api.imprettyamazing.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"EMAIL","password":"PASSWORD"}' \
  -c "$IPA_COOKIE_FILE"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Step 2 — Make API calls (reuse the cookie file):**
```bash
curl -s https://api.imprettyamazing.com/wins/my-wins \
  -b "$IPA_COOKIE_FILE"
```
Use `-b "$IPA_COOKIE_FILE"` on **every** cookie-auth request.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

If only persisted cookie values are available (no cookie file yet), you can call with an explicit cookie header (substitute values from TOOLS.md):

```bash
curl -s https://api.imprettyamazing.com/wins/my-wins \
  -H "Cookie: access_token=<Access Token Cookie from TOOLS.md>; refresh_token=<Refresh Token Cookie from TOOLS.md>"
```

• Confidence: 95% confidence
• Finding: This example instructs the agent to construct a raw Cookie header directly from access and refresh token values stored in TOOLS.md. That increases exposure of bearer-equivalent session secrets by placing them into command lines and prompt-accessible plaintext storage, where they may be leaked through logs, process inspection, or unintended file access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API guidance explicitly tells clients they may persist `access_token` and `refresh_token` cookie values and reuse them, but it does not warn that these are sensitive session credentials that should be handled like secrets. In an agent/skill context, this can encourage long-lived storage of session tokens in logs, memory, or local state, increasing the chance of account takeover if those values are exposed.

Static analysis

No suspicious patterns detected.