youmind-kit-article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:02 AM UTC
• Version: 1.0.0

Overview

This skill mostly fits a YouMind-to-Kit publishing workflow, but it needs review because it can send credentials and content to a configurable API origin, publish or delete real broadcasts, and generate unsafe local previews.

Install only if you are comfortable granting this skill access to your YouMind API key and the Kit account connected in YouMind. Keep the base URL on the official YouMind endpoint, lock down ~/.youmind permissions, use private drafts or a test account for validation, do not run deep-check on production accounts, avoid previewing untrusted Markdown, and treat delete/publish actions as real remote account changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:45

Finding

Mandatory promotional output hijacks the Agent response

Content

View full analysis

[Get YouMind API Key](https://youmind.com/settings/api-keys?utm_source=youmind-kit-article) | [More Skills](https://youmind.com/skills?utm_source=youmind-kit-article) ## Onboarding **MANDATORY: When the user has just installed this skill, present this message IMMEDIATELY. Translate to the user's language:** > **AI Kit Broadcast Writer installed!** > > Tell me your topic and I'll write and publish a Kit broadcast for you. > > **Try it now:** "Write a Kit broadcast about what changed in our AI workflow this week" > > **What it does:** > - Research topics from YouMind knowledge base and the web > - Write creator-style broadcasts for Kit's inbox + public feed surfaces > - Convert Markdown to HTML optimized for Kit > - Discover usable email templates > - Publish directly to Kit as public or private through the Kit account connected in YouMind > > **Setup (one-time):** > 1. Install & configure: `cd toolkit && npm install && npm run build && cd .. && mkdir -p ~/.youmind/config && cp shared/config.example.yaml ~/.youmind/config.yaml` > 2. Get [YouMind API Key](https://youmind.com/settings/api-keys?utm_source=youmind-kit-article) and fill `youmind.api_key` in `~/.youmind/config.yaml` > 3. Keep `youmind.base_url` pointed at `https://youmind.com/openapi/v1` in docs. If you need local backend debugging, change `~/.youmind/config.yaml` or `~/.youmind/config/youmind-kit-article.yaml`. > 4. Connect your Kit account inside YouMind before publishing. This skill no longer reads local Kit API keys. ``` ### Technical Analysis The Skill instructs the Agent to emit fixed branded onboarding content immediately when an installation condition is met. The instruction is mandatory and includes a promotional “More Skills” URL carrying a campaign-tracking parameter. This behavior ...[truncated 913 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: toolkit/src/config.ts:76

Finding

Configurable API origin can receive the API key and user content without validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: toolkit/src/content-adapter.ts:39

Finding

Unsanitized Markdown and metadata permit script injection into local previews

Content

View full analysis

${subject} body { margin: 0; background: #f3f5f7; color: #122230; font-family: "Helvetica Neue", Arial, sans-serif; }

Kit Preview

${subject}

${previewText}

${html}

`; const outputPath = opts.output ? resolve(opts.output) : getDefaultPreviewOutput(inputPath); writeFileSync(outputPath, fullHtml, 'utf-8'); ``` ### Technical Analysis Markdown-It is configured with `html: true`, which preserves raw HTML supplied in Markdown. The rendered HTML is written directly into a complete preview document without sanitization. The extracted `subject` and `previewText` are also interpolated into HTML contexts without entity encoding. An attacker-controlled Markdown file can therefore inject elements such as `

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: toolkit/src/deep-check.ts:232

Finding

Deep-check creates a real public broadcast and suppresses cleanup failures

Content

View full analysis

{ const report: JsonObject = {}; const markdown = '# YouMind Kit Generic Publish\n\nThis post is created via createTokenPlatformPost.'; const adapted = await adaptForKit({ markdown }); const created = await postPublishing( 'createPost', { platform: 'kit', post: { title: adapted.subject, content: { format: 'html', body: adapted.html }, extras: { isPublic: true }, }, }, apiKey, baseUrl, ); const createdId = requireNumber(created.id, 'generic publish broadcast id'); cleanupIds.push(createdId); report.createTokenPlatformPost = created; const fetched = await getBroadcast(loadKitConfig(), createdId); assert.equal(fetched.id, createdId, 'generic publish should create a retrievable Kit broadcast'); assert.equal(fetched.subject, adapted.subject, 'generic publish should preserve the title'); assert.equal(fetched.isPublic, true, 'generic publish should create a public Kit broadcast'); ``` ```ts async function cleanupBroadcasts( config: ReturnType, ids: number[], ): Promise { for (const id of [...new Set(ids)]) { try { await deleteBroadcast(config, id); } catch { // Ignore cleanup failures. } } } ``` ### Technical Analysis The `deep-check` script is not an isolated unit test. It uses the configured account and creates real remote Kit broadcasts, including a broadcast explicitly marked public. Cleanup runs in a `finally` block, which is a useful safeguard, but every deletion exception is silently discarded. Network failures, permission changes, API errors, or process termination can therefor ...[truncated 973 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: toolkit/package.json:11

Finding

Dependency installation is not reproducible because versions are ranged and no lockfile is present

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:99

Finding

Credential setup does not enforce owner-only file permissions

Content

View full analysis

**Canonical credentials:** put your shared YouMind credentials in `~/.youmind/config.yaml` — filled ONCE and read by every YouMind skill. ``` The copied template contains the secret field: ```yaml youmind: api_key: "sk-ym-xxxxxxxxxxxxxxxxxxxx" base_url: "https://youmind.com/openapi/v1" ``` ### Technical Analysis The setup procedure copies a regular project file into the user’s home directory and later instructs the user to store an API key in it. It does not enforce mode `0600` on the credential file or mode `0700` on the containing directory. The resulting permissions depend on the source file mode, platform, and user umask. On a multi-user machine with permissive defaults, another local account may be able to read the key. The runtime loader also does not warn when the configuration file is group-readable or world-readable. ### Attack Path 1. The user runs the documented setup commands under a permissive umask. 2. `config.yaml` is created with permissions readable by other local users or groups. 3. The user inserts the live YouMind API key. 4. Another local account reads `~/.youmind/config.yaml`. 5. The attacker uses the exposed key within its server-side authorization scope. ### Impact Assessment The direct impact is disclosure of the YouMind API key to local users who can traverse the home directory and read the file. Resulting remote access is limited by the key’s permissions but may include knowledge-base access, paid API usage, content creation, and publishing through connected services. The issue does not independently bypass operat ...[truncated 33 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (70)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding indicates a severe description-behavior mismatch in the opposite direction: the skill claims Kit publishing features that are not evidenced, while apparently containing undeclared broad YouMind content access and AI image generation. Hidden or misrepresented capabilities are dangerous because they can induce users to provide API keys or authorize actions under false pretenses, while the actual code may access unrelated data domains.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding indicates a severe description-behavior mismatch in the opposite direction: the skill claims Kit publishing features that are not evidenced, while apparently containing undeclared broad YouMind content access and AI image generation. Hidden or misrepresented capabilities are dangerous because they can induce users to provide API keys or authorize actions under false pretenses, while the actual code may access unrelated data domains.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 34)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 46)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI exposes broad account-management actions such as listing, fetching, validating, templating, and especially deleting broadcasts, which exceed the declared scope of a writing/publishing skill. In an agent setting, this expanded capability increases blast radius: a prompt or workflow intended only to draft/publish content could be steered into enumerating or destroying existing account data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A delete operation is present in a tool advertised for writing and publishing Kit articles, which is a scope mismatch and an unnecessary destructive capability. In a connected-account environment, any unintended invocation could permanently remove user broadcasts, making the skill materially more dangerous than its description suggests.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

This file performs outbound network requests with fetch() to a configurable baseUrl and also invokes API operations that create, update, list, and delete Kit broadcasts. If the skill's declared permissions do not include network access, the runtime capability is broader than advertised, which weakens trust boundaries and can enable unintended data exfiltration or unauthorized external actions when this script is run.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The shared API client exposes a chat-based image-generation capability that is unrelated to the declared purpose of a Kit article writing/publishing skill. Extra capabilities expand the attack surface and can be invoked by other parts of the skill stack to trigger unintended remote actions, data flows, or policy bypasses under the cover of a benign article workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code can start an agent-mode chat and implicitly load additional tooling to fulfill a prompt, which is a broader and less predictable capability than the skill's stated function. In a skill meant for article publishing, allowing agent tool orchestration for image generation creates a dangerous mismatch: prompt-controlled remote tool use may enable unreviewed actions or side effects beyond user expectations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

bash

cd toolkit && npm install && npm run build && cd ..
mkdir -p ~/.youmind/config
cp shared/config.example.yaml ~/.youmind/config.yaml

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that default mode is web-public and includes a public publish command, but the warning about public visibility is not prominent or explicit enough for a tool that can publish content externally. In a writing-and-publishing skill, this increases the risk of accidental disclosure of drafts, confidential business information, or sensitive user-provided content through unintended public posting.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 9)May include surrounding context.

bash

cd toolkit && npm install && npm run build && cd ..
mkdir -p ~/.youmind/config
cp shared/config.example.yaml ~/.youmind/config.yaml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 9)May include surrounding context.

bash

cd toolkit && npm install && npm run build && cd ..
mkdir -p ~/.youmind/config
cp shared/config.example.yaml ~/.youmind/config.yaml

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that publishing is public by default (默认是公开 web feed) and only later mentions --private for drafts, without an explicit warning or required confirmation about visibility. In a skill whose purpose is to publish newsletter/broadcast content to a connected Kit account, this increases the chance of accidental public disclosure of drafts, sensitive business content, or incomplete AI-generated material.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

> **AI Kit Broadcast Writer installed!**
>
> Tell me your topic and I'll write and publish a Kit broadcast for you.
>
> **Try it now:** "Write a Kit broadcast about what changed in our AI workflow this week"
>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs storing drafts in a shared persistent directory under ~/.youmind/articles/kit/, explicitly accessible to all YouMind skills. Cross-skill shared persistence increases data exposure risk because sensitive unpublished content, campaign plans, or customer messaging can be read or modified by other skills or local processes beyond the user's immediate intent.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

## Draft Location Rule

**Canonical:** write local article Markdown files to `~/.youmind/articles/kit/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md).

**Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-kit-article/output/<slug>.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

1. **Self-critique**: Pass all checklist items in the playbook's Step 6
2. **Conformance report**: Generate and present to user (Step 7/8)
3. **Kit fit**: Subject + preview + first screen + CTA are aligned
4. **User approval**: Do not auto-publish without confirmation

### Result Links Rule

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to create, update, list, and delete broadcasts through the connected Kit account, but it does not require an explicit warning or confirmation before making remote state changes. In this context, that can lead to accidental publication, modification, or deletion of user content in a live external service using existing account authority.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The content-brief example specifies language: "en", which can be read as a default requirement rather than a user-selected option. Because this shared contract defines behavior across skills and does not mention user choice or locale opt-in, it risks enforcing a specific language contrary to the language/locale policy.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The contract allows standalone platform skills to read ~/.youmind/author-profile.yaml automatically as fallback state. Reading persisted cross-session profile data can create privacy and consent risks if a skill uses personal preferences or identity information without explicit confirmation in the current request, especially across multiple publishing targets.

Content

Scanner excerpt · shared/DISPATCH_CONTRACT.md (reported line 143)May include surrounding context.

md

Platform skills MUST work in both modes:

### Standalone mode
User invokes the platform skill directly (`"Write an article about X for this platform"`):
- No content brief is provided
- Skill follows its own pipeline from scratch
- **Fallback for author DNA**: skill MAY read `~/.youmind/author-profile.yaml` to apply user voice/preferences. If the shared profile does not exist, proceed with platform defaults. Legacy fallback paths are optional migration aids, not the canonical location.