youmind-beehiiv-article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:00 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a Beehiiv writing and publishing purpose, but it exposes connected-account management actions and under-scoped credential/content handling that should be reviewed before install.

Install only if you are comfortable giving this skill access to a YouMind API key tied to your connected Beehiiv account. Keep youmind.base_url on the official YouMind URL, avoid running delete/update unless you explicitly intend to change existing posts, review Markdown from untrusted sources before previewing or publishing it, and protect or rotate the API key if ~/.youmind/config.yaml is exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:43

Finding

Mandatory Skill Instructions Force Promotional Content into Agent Responses

Content

View full analysis

[Get YouMind API Key](https://youmind.com/settings/api-keys?utm_source=youmind-beehiiv-article) | [More Skills](https://youmind.com/skills?utm_source=youmind-beehiiv-article) ## Onboarding **MANDATORY: When the user has just installed this skill, present this message IMMEDIATELY. Translate to the user's language:** > **AI Beehiiv Post Writer installed!** > > Tell me your topic and I'll write and publish a Beehiiv post for you. > > **Try it now:** "Write a Beehiiv post about how AI coding agents changed weekly product updates" > > **What it does:** > - Research topics from YouMind knowledge base and the web > - Write Beehiiv-native posts for the platform's email + web surfaces > - Convert Markdown to HTML optimized for Beehiiv > - Discover reusable post templates > - Publish directly to Beehiiv through the Beehiiv account connected in YouMind > > **Setup (one-time):** > 1. Install & configure: `cd toolkit && npm install && npm run build && cd .. && mkdir -p ~/.youmind/config && cp shared/config.example.yaml ~/.youmind/config.yaml` > 2. Get [YouMind API Key](https://youmind.com/settings/api-keys?utm_source=youmind-beehiiv-article) and fill `youmind.api_key` in `~/.youmind/config.yaml` ``` ### Technical Analysis The Skill text directs the Agent to emit a fixed, vendor-authored message immediately after installation. The mandatory block includes tracked external links and an unrelated “More Skills” promotional link. A Skill legitimately needs to describe prerequisites, but it should not compel the Agent to inject advertising or referral links into a response independently of the user's current request. The `MANDATORY` and `IMMEDIATELY` directives alter the Agent's response behavior when the Skill is loaded, making this a limited form of instruction hijacking. ...[truncated 996 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: toolkit/src/config.ts:76

Finding

Configurable Base URL Can Redirect API Credentials and User Content to an Arbitrary Host

Content

View full analysis

; } { const raw = loadLayeredConfig(); const youmind = isPlainObject(raw.youmind) ? raw.youmind : {}; const imageYouMind = getImageYouMindConfig(raw); const apiKey = (typeof youmind.api_key === 'string' && youmind.api_key) || (typeof imageYouMind.api_key === 'string' && imageYouMind.api_key) || ''; const configuredBaseUrl = typeof youmind.base_url === 'string' ? normalizeBaseUrl(youmind.base_url) : ''; return { raw, apiKey, baseUrl: configuredBaseUrl || DEFAULT_YOUMIND_OPENAPI_BASE_URL, }; } ``` The resulting URL is used in authenticated requests without validating its scheme or host: ```ts const response = await fetch(`${cfg.baseUrl}${endpoint}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': cfg.apiKey, 'x-use-camel-case': 'true', }, body: JSON.stringify(body), signal: AbortSignal.timeout(30_000), }); ``` The same pattern appears in the general YouMind client: ```ts const resp = await fetch(`${cfg.baseUrl}${endpoint}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': cfg.apiKey, }, body: JSON.stringify(body), signal: AbortSignal.timeout(endpoint.includes('Chat') || endpoint.includes('Message') ? 120_000 : 15_000), ...[truncated 2487 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: toolkit/src/content-adapter.ts:67

Finding

Raw HTML from Markdown Is Rendered and Published Without Sanitization

Content

View full analysis

>(frontmatter.beehiiv) ?? {}; const title = extractTitle( bodyMarkdown, pickString(options.title, beehiiv.title, frontmatter.title), ); const subtitle = normalizeOptionalText( pickString(options.subtitle, beehiiv.subtitle, frontmatter.subtitle), ); const previewText = extractPreview( bodyMarkdown, pickString( beehiiv.previewText, frontmatter.previewText, frontmatter.preview, frontmatter.description, ), ); const html = md.render(bodyMarkdown.replace(/^#\s+.+\n?/, '')); ``` The local conversion function uses the same unsanitized renderer: ```ts export function convertToHtml(markdown: string): { html: string; title: string; previewText: string; } { const { frontmatter, bodyMarkdown } = parseFrontmatter(markdown); const beehiiv = pickObject>(frontmatter.beehiiv) ?? {}; const title = extractTitle(bodyMarkdown, pickString(beehiiv.title, frontmatter.title)); const html = md.render(bodyMarkdown.replace(/^#\s+.+\n?/, '')); return { html, title, previewText: extractPreview( bodyMarkdown, pickString( beehiiv.previewText, frontmatter.previewText, frontmatter.preview, frontmatter.description, ), ), }; } ``` ### Technical Analysis `markdown-it` is explicitly configured with `html: true`. Consequently, raw HTML embedded in a Markdown document is preserved in the generated output rather than esca ...[truncated 1968 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: toolkit/package.json:17

Finding

Dependency Installation Is Not Reproducible Because No Lockfile Is Shipped and Versions Use Mutable Ranges

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (70)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description partially matches the code: the code does support Markdown-to-HTML preview/conversion and publishing to a connected Beehiiv account. However, the declared description emphasizes AI writing and topic research via YouMind knowledge base, which are not present in this code chunk. More importantly for mismatch detection, the code exposes several undeclared operational capabilities beyond writing/publishing: validate connectivity, list templates, list posts, get a post, update a post, and delete/archive a post. These are material Beehiiv management actions not represented in the declared purpose. Therefore the description does not accurately represent the full behavior of the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk implements configuration loading for YouMind credentials and endpoint settings, using local files in the user's home directory. That may be a supporting utility for a larger skill, but within the supplied chunk there is no Beehiiv interaction, no content creation, no HTML conversion, and no publication logic. Because the declared purpose centers on writing and publishing Beehiiv posts while the actual code only handles config management for YouMind, the supplied code does not accurately represent the declared behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on creating and publishing Beehiiv posts, but the supplied code only implements YouMind-side operations: search, web search, board/material/craft listing and retrieval, saving markdown documents to YouMind, topic mining, and AI image generation. There is no code that references Beehiiv endpoints, authentication, post creation, newsletter publication, or HTML conversion. The closest relevant feature is research/mining from YouMind and saving an article into YouMind, which is insufficient to match the stated Beehiiv publishing purpose. Additionally, the image-generation feature is an undeclared capability unrelated to the declared Beehiiv workflow.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 34)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 46)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The delete command enables destructive remote modification of Beehiiv content even though the skill is presented as a writing/publishing tool. Because the skill operates against an already connected Beehiiv account, exposing deletion materially increases risk of accidental or unauthorized loss of posts and is not justified by the declared workflow.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

bash

cd toolkit && npm install && npm run build && cd ..
mkdir -p ~/.youmind/config
cp shared/config.example.yaml ~/.youmind/config.yaml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 9)May include surrounding context.

bash

cd toolkit && npm install && npm run build && cd ..
mkdir -p ~/.youmind/config
cp shared/config.example.yaml ~/.youmind/config.yaml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 9)May include surrounding context.

bash

cd toolkit && npm install && npm run build && cd ..
mkdir -p ~/.youmind/config
cp shared/config.example.yaml ~/.youmind/config.yaml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

> **AI Beehiiv Post Writer installed!**
>
> Tell me your topic and I'll write and publish a Beehiiv post for you.
>
> **Try it now:** "Write a Beehiiv post about how AI coding agents changed weekly product updates"
>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instructions direct users to place a long-lived YouMind API key in a local config file, but they do not include basic credential-handling safeguards such as file permissions, exclusion from source control, rotation guidance, or preference for environment/secret storage. If the file is copied, backed up insecurely, or exposed via logs or shared systems, the key could enable unauthorized access to the user's YouMind and connected publishing workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 79% confidence

Finding

The setup verification step uses npx tsx without pinning a specific package version, which can pull whatever version is current at execution time. This creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code on the user's machine during validation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill instructs storage of article drafts in a shared home directory accessible to all YouMind skills. That increases the blast radius for sensitive content, because other skills or local users/processes may read or reuse unpublished drafts, proprietary writing, or embedded secrets accidentally included in article content.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md

## Draft Location Rule

**Canonical:** write local article Markdown files to `~/.youmind/articles/beehiiv/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md).

**Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-beehiiv-article/output/<slug>.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

1. **Self-critique**: Pass all checklist items in the playbook's Step 6
2. **Conformance report**: Generate and present to user (Step 7/8)
3. **Beehiiv fit**: title + subtitle + first screen + segmentation/template decisions are aligned
4. **User approval**: Do not auto-publish without confirmation

### Result Links Rule

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The pipeline directs the agent to mine the YouMind knowledge base, use web search, and publish through external APIs without requiring any privacy notice or confirmation about transmitting content to third parties. Because this skill is specifically designed to draft and publish newsletter content, the data involved may include unpublished business content, audience strategy, or proprietary research, making undisclosed external transmission a meaningful privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The pipeline explicitly instructs saving generated article drafts to a local path under the user's home directory, but it provides no requirement to obtain consent, disclose disk persistence, or handle sensitive source material carefully. In a skill that may process unpublished newsletter content, internal research, or user-provided material, silent local storage increases the risk of unintended retention, exposure to other local users/processes, and compliance/privacy issues.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The contract allows standalone platform skills to read ~/.youmind/author-profile.yaml implicitly as fallback state, introducing cross-session persistence and ambient context use without explicit per-invocation consent. In an AI publishing workflow, this can cause unintended disclosure of sensitive author preferences, identities, or prior configuration into generated content or downstream publishing actions, especially when users expect isolated task handling.

Content

Scanner excerpt · shared/DISPATCH_CONTRACT.md (reported line 143)May include surrounding context.

md

Platform skills MUST work in both modes:

### Standalone mode
User invokes the platform skill directly (`"Write an article about X for this platform"`):
- No content brief is provided
- Skill follows its own pipeline from scratch
- **Fallback for author DNA**: skill MAY read `~/.youmind/author-profile.yaml` to apply user voice/preferences. If the shared profile does not exist, proceed with platform defaults. Legacy fallback paths are optional migration aids, not the canonical location.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · shared/DISPATCH_CONTRACT.md (reported line 171)May include surrounding context.

md

| File | Owned by | Purpose |
|------|----------|---------|
| `shared/DISPATCH_CONTRACT.md` (this file) | Shared | The interface definition |
| `skills/youmind-article-dispatch/SKILL.md` | Hub | Hub behavior, onboarding, dispatch pipeline |
| `skills/youmind-article-dispatch/references/content-brief-format.md` | Hub | Brief schema detail |
| `~/.youmind/author-profile.yaml` | Shared user home | User's cross-platform author DNA |
| `~/.youmind/dispatch-roster.yaml` | Shared user home | User's active platform list |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · shared/PUBLISHING.md (reported line 3)May include surrounding context.

md

# Publishing Guidelines

This file captures shared publishing rules for YouMind skills that create drafts, publish posts, or hand content off to external platforms.

## Default Safety Rules

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI exposes additional remote post-management actions such as listing, fetching, template enumeration, updating, and deleting posts that go beyond the skill's stated purpose of writing and publishing Beehiiv articles. In a connected-account context, this expands the blast radius of the skill and creates capability mismatch: a user invoking an article-writing skill may unintentionally grant an agent access to unrelated publication-management operations.

Content

No source excerpt is available for this finding.