T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/hinge_android.py:244- Finding
Gemini API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Hinge Auto-Liker
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it automates dating-app actions while uploading and retaining sensitive profile data with weak consent, secret-handling, and safety controls.
Review carefully before installing. Use only a dedicated emulator account, assume profile screenshots and generated summaries may be sent to Google Gemini and stored locally, avoid saving recordings unless needed, do not hardcode API keys in cron, and require explicit confirmation before any run that sends likes or comments.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:80- Finding
Documentation Directs Users to Hardcode a Persistent API Credential in Cron Configuration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/hinge_android.py:292- Finding
Untrusted AI-Generated Comment Is Passed to an Android Shell with Incomplete Escaping
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/hinge_android.py:184- Finding
Sensitive Dating-Profile Screenshots and Personal Summaries Are Retained Without Cleanup Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (22)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description says it uses Gemini vision to evaluate dating profiles but does not clearly warn that profile images, prompts, and inferred attractiveness data may be transmitted to an external AI service. In this context, the omitted warning is significant because dating profiles contain sensitive personal data and users may not expect third-party processing.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions recommend screen recording and pulling session videos to local storage without warning about the sensitivity of captured dating profiles and conversations. Those recordings and logs can contain personal images, bios, app identifiers, and behavioral data, making them highly privacy-sensitive if retained or shared insecurely.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/hinge_android.py --likes 8 --user-desc "a 25yo tech guy in SF who's fit and active"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill sends screenshots and profile metadata from a dating app to an external AI provider, including personal images and inferred attributes, without any runtime consent prompt or minimization. In this context, the data is highly sensitive and third-party disclosure can violate privacy expectations, platform rules, or legal obligations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares no explicit tool scope even though it clearly relies on shell execution, environment variables, and file writes. That mismatch weakens security boundaries and informed consent because an orchestrator or reviewer cannot easily tell that the skill can launch emulators, access secrets, and persist artifacts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation guidance is broad enough that ordinary conversation like 'check Hinge status' or 'manage daily dating app swiping' could trigger high-impact automation. Because this skill can drive an emulator, send likes, generate comments, and handle sensitive dating data, accidental invocation could cause unintended actions and privacy issues.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs collection and sharing of detailed summaries of liked and skipped profiles plus optional session video recordings. That creates a pipeline for storing and transmitting sensitive third-party personal data beyond what is necessary to automate likes, increasing privacy, compliance, and misuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The cron guidance omits any warning that hardcoding an API key creates credential exposure risks. In operational environments, cron definitions are often readable by admins, included in backups, and may be copied into tickets or docs, so the missing warning materially increases the chance of secret compromise.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Embedding a secret API key directly into cron payloads is unsafe because cron entries, scripts, and execution metadata can leak secrets to other users, support staff, backups, or logs. This is especially risky because the key grants access to an external AI service and could be abused for cost, data access, or service misuse.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly tells users to hardcode the Gemini API key into cron payloads. Embedding secrets in cron commands can expose them through process listings, shell history, logs, configuration backups, and accidental sharing, creating a straightforward credential leakage path.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The analysis prompt instructs the model to evaluate profiles using language like 'Is she attractive?' and assumes the user is 'a guy on Hinge,' forcing a specific gendered framing without user choice. This is a natural-language policy issue because it imposes a fixed demographic/interaction model rather than offering configurable or neutral language.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def adb_cmd(*args): try: result = subprocess.run([ADB] + list(args), capture_output=True, text=True, timeout=30) return result.stdout.strip() except subprocess.TimeoutExpired: log(f" ⚠️ ADB command timed out: {args}")
Tainted flow: 'ADB' from os.environ.get (line 29, credential/environment) → subprocess.run (code execution)
Medium
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The script trusts the ADB executable path from environment or CLI and executes it directly. If an attacker can influence ADB_PATH or --adb, they can cause arbitrary local program execution with the privileges of the agent running the skill.
- Content
python def adb_cmd(*args): try: result = subprocess.run([ADB] + list(args), capture_output=True, text=True, timeout=30) return result.stdout.strip() except subprocess.TimeoutExpired: log(f" ⚠️ ADB command timed out: {args}")
Tainted flow: 'path' from os.environ.get (line 197, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python def screenshot(path): with open(path, "wb") as f: subprocess.run([ADB, "exec-out", "screencap", "-p"], stdout=f, timeout=10)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def screenshot(path): with open(path, "wb") as f: subprocess.run([ADB, "exec-out", "screencap", "-p"], stdout=f, timeout=10) def dump_ui():
Tainted flow: 'ADB' from os.environ.get (line 29, credential/environment) → subprocess.run (code execution)
Medium
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
This subprocess invocation inherits the same untrusted ADB executable path issue as adb_cmd(). A manipulated ADB value can replace the intended Android tooling with any local executable, leading to arbitrary code execution during screenshot capture.
- Content
python def screenshot(path): with open(path, "wb") as f: subprocess.run([ADB, "exec-out", "screencap", "-p"], stdout=f, timeout=10) def dump_ui():
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def dump_ui(): try: adb_cmd("shell", "uiautomator", "dump", "/sdcard/ui_dump.xml") subprocess.run([ADB, "pull", "/sdcard/ui_dump.xml", "/tmp/ui_dump.xml"], capture_output=True, text=True, timeout=10) with open("/tmp/ui_dump.xml") as f: return f.read()
Tainted flow: 'ADB' from os.environ.get (line 29, credential/environment) → subprocess.run (code execution)
Medium
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The code executes the ADB binary again using a path that may come from environment variables or command-line input. In an agent setting, this is particularly risky because a caller who can shape execution context may turn a mobile-automation helper into a local code-execution vector.
- Content
python def dump_ui(): try: adb_cmd("shell", "uiautomator", "dump", "/sdcard/ui_dump.xml") subprocess.run([ADB, "pull", "/sdcard/ui_dump.xml", "/tmp/ui_dump.xml"], capture_output=True, text=True, timeout=10) with open("/tmp/ui_dump.xml") as f: return f.read()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script stores screenshots of profiles and detailed action logs locally, including summaries and comments tied to individuals. Because the content involves dating profiles, this creates a meaningful privacy and confidentiality risk if the host system is shared, compromised, or backed up insecurely.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python json.dump(payload, tmp) tmp_path = tmp.name result = subprocess.run( ["curl", "-s", "-X", "POST", f"{GEMINI_URL}?key={GEMINI_API_KEY}", "-H", "Content-Type: application/json",
Tainted flow: 'GEMINI_URL' from os.environ.get (line 32, credential/environment) → subprocess.run (code execution)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python json.dump(payload, tmp) tmp_path = tmp.name result = subprocess.run( ["curl", "-s", "-X", "POST", f"{GEMINI_URL}?key={GEMINI_API_KEY}", "-H", "Content-Type: application/json",
Tainted flow: 'log_file' from os.environ.get (line 427, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 85% confidence
- Finding
LOG_DIR is derived from HINGE_WORK_DIR, which comes from the environment, and is used for file writes without confinement checks. An attacker controlling that environment variable could redirect sensitive logs into arbitrary writable locations, causing unintended file overwrite or privacy exposure.
- Content
python # Save JSON log log_file = LOG_DIR / f"{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.json" with open(log_file, "w") as f: json.dump(summary, f, indent=2) log(f"Log saved: {log_file}")
Static analysis
No suspicious patterns detected.