Intelligence Suite

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.0

Overview

The skill broadly matches its news-briefing purpose, but it sends the configured API key and scraped article content to an undeclared API host and fetches article URLs without enough network scoping.

Review before installing. Use this only if you are comfortable with scraped news excerpts and your SKILLBOSS_API_KEY being sent to the implemented heybossai.com API endpoint, or require the publisher to align the declared hostname with the code. Run it in a network-restricted environment or patch URL allowlisting before use, and prefer pinned dependencies with a lockfile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan.js:44

Finding

Unrestricted Fetching of Externally Controlled Article URLs Enables SSRF

Content

View full analysis

{ const { data } = await axios.get(`https://hacker-news.firebaseio.com/v0/item/${id}.json`); return data; })); return stories .filter(s => s && KEYWORDS.some(k => s.title?.includes(k))) .slice(0, 3) .map(s => ({ source: "Hacker News", title: s.title, link: s.url || `https://news.ycombinator.com/item?id=${s.id}`, raw_summary: "Community discussion" })); } catch (e) { return []; } } ``` ```js for (const item of items) { console.log(`\nReading: ${item.title}...`); const content = await fetchContent(item.link); ``` Equivalent vulnerable behavior in `scripts/monitor.js`: ```js async function fetchContent(url) { try { const { data } = await axios.get(url, { headers: { 'User-Age ...[truncated 2796 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/scan.js:132

Finding

Untrusted Web Content Is Embedded Directly into LLM Instructions

Content

View full analysis

`[${p.source}] ${p.title}\n${p.content}` ).join('\n\n---\n\n'); const prompt = `You are Makima from Chainsaw Man. Provide a cold, precise, strategic intelligence briefing based on the following AI news signals. Identify the most significant developments, their implications, and any patterns worth noting. Be analytical, composed, and insightful.\n\n${packsText}`; const result = await pilot({ type: 'chat', inputs: { messages: [{ role: 'user', content: prompt }] }, prefer: 'balanced' }); const analysis = result.result.choices[0].message.content; ``` From `scripts/monitor.js`: ```js console.log("Initiating LLM analysis via SkillBoss API Hub..."); const packsText = packsForAnalysis.map(p => `[${p.category} / ${p.source}] ${p.title}\n${p.content}` ).join('\n\n---\n\n'); const prompt = `You are Makima from Chainsaw Man. Provide a cold, composed, strategic global intelligence briefing based on the following world news events. Highlight geopolitical tensions, power shifts, and any patterns that a strategist should note. Be precise and analytical.\n\n${packsText}`; const result = await pilot({ type: 'chat', inputs: { messages: [{ role: 'user', content: prompt }] }, prefer: 'balanced' }); const analysis = result.result.choices[0].message.content; ``` ### Technical Analysis The scripts concatenate trusted task instructions and untrusted article text into the same user message. Article pages can contain attacker-authored language that resembles model instructions, such as directions to ignore the requested briefing, invent conclusions, suppress selected inform ...[truncated 1531 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:8

Finding

Bearer Credential and Collected Content Are Sent to an Undeclared API Hostname

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

SKILLBOSS_API_KEY=your_key node scripts/scan.js --report

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

SKILLBOSS_API_KEY=your_key node scripts/monitor.js --report

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The code is hardwired to use an external service endpoint and later sends compiled news packs to it for analysis. An external endpoint alone is not inherently malicious, but in this skill context it enables off-platform data exfiltration to a third party, which becomes security-relevant because the tool scrapes remote content and forwards it outside the local trust boundary.

Content

Scanner excerpt · scripts/monitor.js (reported line 20)May include surrounding context.

js

const parser = new Parser();

const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = 'https://api.heybossai.com/v1';

async function pilot(body) {
    const r = await axios.post(

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends aggregated third-party article content and titles to an external LLM service without any runtime consent, warning, redaction, or policy gate. Even though the data is news content rather than obvious secrets, external transmission can still create licensing, privacy, and data-governance issues, especially if scraped pages unexpectedly contain personal or restricted information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan.js (reported line 20)May include surrounding context.

js

const parser = new Parser();

const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = 'https://api.heybossai.com/v1';

async function pilot(body) {
    const r = await axios.post(

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script collects scraped content from third-party news pages and sends that content to an external LLM service without any user-facing notice, consent flow, or data-minimization guardrail. Because fetched pages may contain copyrighted, sensitive, or unexpectedly private information, this creates a real data egress risk and expands trust to an external processor without transparency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The phrase "Makima's personal intelligence unit" is a natural-language instruction that frames the skill's behavior around a specific persona rather than the user's own preferences or context. While not a hard locale restriction, it is an organizational-style policy concern because it prescribes a specific presentation mode without offering user choice or opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest file only describes the skill as a "Comprehensive intelligence suite for AI and global news," which is a very broad capability statement without any specific invocation boundaries, trigger phrases, or exclusions. In a manifest context, that lack of specificity can contribute to unintended activation because the description overlaps with many general news or AI-related requests.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using a caret range for axios allows future compatible releases to be installed without explicit review, which can introduce supply-chain risk or unexpectedly pull in a vulnerable version. In a skill that retrieves external news/content, dependency behavior matters because network-facing libraries are part of the attack surface.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"test": "echo \"Error: no test specified\" && exit 1"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "rss-parser": "^3.13.0"
  },

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest references axios with a non-exact version while public advisories exist for some axios releases, so reviewers cannot verify from this file whether deployed installations are affected. Since axios is a network client and this skill’s purpose involves fetching external content, unresolved dependency-version ambiguity can expose the skill to issues such as SSRF bypasses, response tampering, or other request-handling flaws if a vulnerable release is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Using a caret range for rss-parser means installs may resolve to different versions over time, weakening reproducibility and increasing supply-chain exposure. Because this skill processes remote feed content, parser behavior changes could affect security and reliability if an unsafe or compromised release is introduced.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "rss-parser": "^3.13.0"
  },
  "keywords": ["intelligence", "news", "ai", "makima"],
  "author": "Makima",

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script reads SKILLBOSS_API_KEY from the environment to authorize external API requests. Although this is common, there is no nearby comment, prompt, or user-facing documentation warning that the skill depends on a credential and will use it to contact a remote service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.