youmind-devto-article

• Outcome: Review
• Latest audit: May 28, 2026 · 11:01 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Dev.to publishing skill that uses a YouMind API key and remote publishing APIs, with sensitive but purpose-aligned behavior users should control carefully.

Install only if you are comfortable giving the skill a YouMind API key and letting it access your YouMind content and send article drafts to YouMind/Dev.to. Keep draft mode as the default, review drafts for secrets or private content, and require explicit confirmation before public publishing, publish/unpublish-by-ID, or image generation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares executable Bash tools and describes use of shared config files and remote YouMind/Dev.to services, which implies access to environment data and outbound network activity without an explicit permission model. That creates an authorization gap: users and hosting platforms may not realize the skill can read sensitive local configuration and perform authenticated remote actions like publishing content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose frames the skill as article writing/publishing, but the behavior set extends into account validation, listing and modifying existing Dev.to posts, YouMind library enumeration, document storage, web search, and image generation. This broader capability surface increases the chance of over-collection, unintended account actions, or user surprise, especially because some actions affect existing remote content rather than only creating a new draft.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI exposes additional account-management actions beyond the skill’s stated purpose of writing and publishing new Dev.to articles, including listing drafts/published posts and changing publication state of existing articles. In an agent-skill context, this expands the effective permission scope and could let a prompt-triggered or misused skill enumerate private content or modify previously created articles, increasing the blast radius of compromise or misuse.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly documents a `--publish` mode for directly making articles public, but it does not clearly warn users that this causes immediate external visibility and potential disclosure of unfinished, sensitive, or unintended content. In a skill that automates publishing to a real external platform, lack of an explicit visibility warning increases the risk of accidental public release.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The pipeline explicitly instructs the agent to read a local config file containing a user API key, but it does not require user notice, consent, or minimization when accessing that sensitive credential. In an agent setting, silent credential access can violate user expectations and create risk of unintended disclosure, misuse, or propagation into logs and downstream tools.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The pipeline directs the agent to perform network operations against YouMind and Dev.to, which may transmit user prompts, article drafts, research topics, and account-linked metadata to third parties without any explicit warning or confirmation step. In this context, the skill is designed to mine a knowledge base and publish content, so undisclosed data transfer is a meaningful privacy and security concern.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The shortcut `write about X` is broad enough to match ordinary conversational requests that do not clearly indicate the user wants this specific skill to activate. In a skill that can read local config, query external services, and eventually publish content, ambiguous activation materially increases the chance of unintended sensitive actions.

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: The routing shortcuts are presented as examples rather than a strict, bounded activation policy, leaving room for inconsistent or overly permissive invocation. While less severe than a single dangerously broad trigger, this ambiguity increases the likelihood of accidental skill activation and unintended network or credential-handling behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Draft Location Rule

**Canonical:** write local article Markdown files to `~/.youmind/articles/devto/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md).

**Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-devto-article/output/<slug>.md`.

• Confidence: 90% confidence
• Finding: The skill directs article drafts to a shared home directory under ~/.youmind that is available to multiple YouMind skills. Cross-skill shared storage can expose unpublished content, metadata, or drafts to other skills or processes, enabling unintended data access or tampering if isolation controls are weak.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-reference.md:12

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: shared/config.example.yaml:2