Security audit

youmind-beehiiv-article

Security checks across malware telemetry and agentic risk

Overview

This Beehiiv publishing skill is mostly coherent, but it includes connected-account post deletion without a clear confirmation guard.

Review before installing. Use draft mode by default, protect ~/.youmind/config.yaml as a secret, and connect Beehiiv only if you are comfortable with this skill creating, updating, listing, and potentially deleting posts in that account. Avoid the delete command unless you intentionally want to remove a specific post, and avoid confidential source material unless sending it to YouMind, Beehiiv, and web-search services is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares only allowed tools but does not transparently declare the effective capabilities it uses, including network access and environment/config access. That matters because the skill is designed to publish content via external services and read local configuration, so users and policy engines may underestimate what data can be accessed or where content can be sent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The manifest frames the skill primarily as a writer/publisher, but the documented behavior extends to broader content management, knowledge-base access, external research, saving content back into YouMind, and potentially destructive post operations. This mismatch is security-relevant because users may invoke the skill expecting limited behavior while the implementation can access, modify, or persist significantly more data than advertised.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file exposes a deletePost capability even though the skill is described only as writing and publishing Beehiiv articles. This creates unnecessary destructive authority that could be invoked by a compromised prompt flow, tool misuse, or future code paths, enabling deletion of newsletter content outside user expectations.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Destructive post deletion is not justified by the stated purpose of article writing and publishing, so it violates least privilege. In the context of an AI-driven publishing skill connected to a live Beehiiv account, any unintended invocation could remove published or draft content and disrupt business communications.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI exposes additional high-impact content management operations such as listing, fetching, templating, and deletion that go beyond the skill’s declared purpose of writing and publishing Beehiiv articles. In an agent-skill setting, this scope expansion increases the blast radius: a user or prompt that merely intends publication can be routed through a tool that also has account-wide read/delete powers, violating least privilege and making misuse easier.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The delete command provides destructive post-management capability that is not justified by the stated skill purpose of drafting and publishing newsletters. In a connected account context, this creates a direct path for unintended or malicious archival/deletion of existing content, and an agent invoking the skill under ambiguous instructions could cause irreversible business or reputational damage.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file adds a chat-based AI image generation capability that is outside the declared scope of a Beehiiv article-writing/publishing skill. In an agent-skill context, hidden out-of-scope capabilities materially increase attack surface and can enable unintended tool use, extra network actions, or abuse of connected accounts/services without clear user expectation.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code starts a general-purpose agent chat (`message_mode: 'agent'`) and instructs it to load a tool and generate an image. Using a broad agent flow inside a narrowly scoped publishing skill is dangerous because the agent may have access to additional tools or behaviors not intended by the manifest, creating a capability mismatch and raising the risk of unintended actions driven by prompt content or backend tool availability.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README instructs users to store a long-lived API key in a persistent file under their home directory, but it provides no warning about credential sensitivity, file permissions, rotation, or safer secret-handling options. While this is common documentation practice, it increases the chance of accidental disclosure through backups, screenshots, shell history, shared machines, or world-readable config files.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The pipeline explicitly includes live-content actions such as `createPost`, `updatePost`, and `deletePost` without requiring a user confirmation or warning about their real-world effects. In a skill that can publish to an already connected Beehiiv account, this increases the risk of accidental publication, modification, or deletion of newsletter content due to ambiguous prompts or agent misexecution.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The pipeline instructs the skill to save working drafts under `~/.youmind/articles/beehiiv/<slug>.md` without warning that user-provided or generated content may be written to local disk. This can create unintended persistence of sensitive draft material, especially on shared machines or environments where local storage is backed up, inspected, or reused across sessions.

Session Persistence

Medium

Category: Rogue Agent
Content: ## Draft Location Rule **Canonical:** write local article Markdown files to `~/.youmind/articles/beehiiv/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md). **Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-beehiiv-article/output/<slug>.md`.
Confidence: 90% confidence
Finding: write local article Markdown files to `~/.youmind/articles/beehiiv/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md).

Session Persistence

Medium

Category: Rogue Agent
Content: Platform skills MUST work in both modes: ### Standalone mode User invokes the platform skill directly (`"Write an article about X for this platform"`): - No content brief is provided - Skill follows its own pipeline from scratch - **Fallback for author DNA**: skill MAY read `~/.youmind/author-profile.yaml` to apply user voice/preferences. If the shared profile does not exist, proceed with platform defaults. Legacy fallback paths are optional migration aids, not the canonical location.
Confidence: 88% confidence
Finding: Write an article about X for this platform"`): - No content brief is provided - Skill follows its own pipeline from scratch - **Fallback for author DNA**: skill MAY read `~/.youmind

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-reference.md:8

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: shared/config.example.yaml:2