Security audit

youmind-article-dispatch

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for multi-platform publishing, but it needs review because it can post broadly, mine prior YouMind content, archive articles, and persist writing profiles without consistently requiring explicit consent first.

Install only if you are comfortable with a hub that can coordinate posting through multiple connected accounts, read prior YouMind materials for personalization, and keep shared profile/roster files under ~/.youmind. Before using live publish or publish everywhere, confirm the exact target platforms, prefer draft mode first, review any localization, and inspect or remove ~/.youmind/author-profile.yaml, dispatch-roster.yaml, and learning-log.yaml if you do not want persistent profiling.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The protocol explicitly supports single-platform routing, which contradicts the skill metadata stating this dispatch skill should not trigger for single-platform requests and is only for orchestration across multiple platforms. This mismatch can cause incorrect skill selection, unexpected execution paths, and delegation to publishing-capable downstream skills when a narrower, platform-specific skill should have been used instead.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The broad trigger phrase 'Publish everywhere' can cause unintended activation of a high-impact action affecting multiple external accounts. In an agent setting, vague triggers increase the chance of accidental cross-posting, especially when publishing and archiving are side-effectful operations.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The usage guidance reinforces a vague activation phrase for a potentially destructive or reputation-impacting workflow. Without mandatory confirmation, users may trigger posting to all configured destinations unintentionally.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README describes actions that can publish content to external accounts and archive data back into a knowledge base, but it does not prominently warn that these operations modify external systems and user data. In an agentic environment, lack of explicit side-effect warnings increases the risk of unintentional account actions and privacy surprises.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: Automatically forcing Chinese localization for WeChat without clear user opt-in can alter meaning, audience, and disclosure expectations, causing unintended or misleading publication. While not a classic exploit, it is a safety and integrity issue because the system may transform content in a way the user did not authorize.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: Defaulting Qiita output to Japanese-focused content without opt-in may publish unintended translations or culturally adapted content that the user did not review. This mainly threatens content integrity and user intent rather than confidentiality or system security.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README describes semantic search, internet search, and automatic post-publication archiving back into YouMind, but it does not clearly warn users that article content, prompts, and potentially source materials may be transmitted to external services and written back to a remote knowledge base. In a multi-platform publishing skill, these behaviors can cause unintended disclosure or persistence of sensitive drafts, proprietary material, or personal data if users assume the skill is only formatting content locally.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs saving platform roster and author-profile data into persistent local files under ~/.youmind without a clear, explicit user warning or consent flow. That creates a privacy risk because behavioral preferences, platform choices, and writing-profile metadata can be retained across sessions on disk and later accessed by other local processes, users, or skills.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs the agent to fetch and analyze the user's recent 10–15 YouMind articles to infer an 'author DNA' profile, but it does not require explicit opt-in or a privacy warning before profiling existing content. This is dangerous because it expands processing from the immediate user request into retrospective content analysis, potentially exposing sensitive themes, writing habits, or private knowledge-base material the user did not expect to be mined.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger set includes broad phrases like "publish everywhere," "cross-post," and "distribute content," which can match normal conversational requests without enough confirmation of scope. In an orchestration skill that fans out content to multiple downstream publishing skills, ambiguous activation increases the chance of unintended multi-platform posting, amplifying user error across several services at once.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The spec explicitly says the skill will read and write a persistent shared profile at ~/.youmind/author-profile.yaml, but it does not require a clear user-facing disclosure or consent flow before modifying that file. In an agent setting, silent persistence can surprise users, create cross-skill data exposure, and allow long-lived preference changes that affect later actions without the user realizing it.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The bootstrap flow instructs the skill to fetch and analyze 10–15 existing articles from the user's knowledge base to infer writing traits, but it does not require an explicit privacy notice or consent for that retrospective analysis. Even if the data is the user's own content, bulk profiling from historical documents can reveal sensitive patterns and exceeds what many users expect from a dispatch/orchestration skill.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Broad aliases such as "all" and "everywhere" are highly ambiguous and can match ordinary user language, causing the dispatch skill to activate more often than intended. In a skill that fans out to multiple platform-specific publishing skills, accidental invocation can expand scope from a simple content request into mass distribution across installed targets.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: shared/config.example.yaml:2