youmind-qiita-article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:02 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Qiita writing purpose, but its CLI can publish publicly despite private-by-default documentation and includes account-changing commands that deserve review.

Review this skill before installing. Use it only with a YouMind API key you are comfortable granting publishing-related access, keep youmind.base_url on the official YouMind endpoint unless you are deliberately testing locally, and do not rely on the current CLI to keep posts private unless you explicitly pass --private or set private: true in front matter. Treat update, delete, and set-public commands as account-impacting actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: toolkit/src/config.ts:110

Finding

Configurable API endpoint can disclose the YouMind API key and user content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: toolkit/src/cli.ts:115

Finding

Publishing defaults to public despite the documented private-by-default policy

Content

View full analysis

', 'Markdown file path') .option('--private', 'Publish as private (limited sharing)') .option('--public', 'Publish publicly (default)') .option('--tags ', 'Comma-separated tags (max 5)') .option('--tweet', 'Announce to Twitter/X if integration enabled (first publish only)') .option('--slide', 'Enable slide/presentation mode') .action(async (input: string, opts) => { const cfg = ensureConfig(); const filePath = resolve(input); if (!existsSync(filePath)) { console.error(`Error: File not found: ${filePath}`); process.exit(1); } const raw = readFileSync(filePath, 'utf-8'); const { data: fm, content } = parseFrontMatter(raw); const title = (fm.title as string) || basename(input, '.md'); const tags = parseTags(opts.tags, fm.tags); const isPrivate = opts.private === true ? true : opts.public === true ? false : Boolean(fm.private); ``` The publisher independently defaults to public: ```ts export async function publish(options: PublishOptions): Promise { const { config, title, markdown, tags, private: isPrivate = false, tweet = false, slide = false, } = options; ``` ### Technical Analysis When the user supplies neither `--private` nor `--public`, and the Markdown front matter does not contain `private: true`, `Boolean(fm.private)` evaluates to `false`. That value is sent through the publishing layer and becomes the published state. The high-level publisher also assigns `private: isPrivate = false`, creating a second public-by-default behavior for callers that omit the property. This direct ...[truncated 1512 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: toolkit/package.json:17

Finding

Dependency installation is not reproducible because no lockfile is provided

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (80)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill advertises a narrower write/publish workflow, but the analysis indicates it may also support listing, reading, updating, deleting, and changing visibility of existing Qiita content. Undisclosed content-management capabilities increase the chance that a user invokes the skill without understanding it can modify or remove existing articles, creating integrity and account-impact risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill advertises a narrower write/publish workflow, but the analysis indicates it may also support listing, reading, updating, deleting, and changing visibility of existing Qiita content. Undisclosed content-management capabilities increase the chance that a user invokes the skill without understanding it can modify or remove existing articles, creating integrity and account-impact risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill advertises a narrower write/publish workflow, but the analysis indicates it may also support listing, reading, updating, deleting, and changing visibility of existing Qiita content. Undisclosed content-management capabilities increase the chance that a user invokes the skill without understanding it can modify or remove existing articles, creating integrity and account-impact risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill advertises a narrower write/publish workflow, but the analysis indicates it may also support listing, reading, updating, deleting, and changing visibility of existing Qiita content. Undisclosed content-management capabilities increase the chance that a user invokes the skill without understanding it can modify or remove existing articles, creating integrity and account-impact risk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 4)May include surrounding context.

md

# YouMind Qiita OpenAPI Reference

This skill talks to Qiita exclusively through YouMind's OpenAPI proxy. The
end user only ever supplies a YouMind API key; the Qiita personal access
token is held server-side after the user connects Qiita inside YouMind.

Base URL: `https://youmind.com/openapi/v1` (override via `youmind.base_url`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 34)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 46)May include surrounding context.

md

1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · toolkit/src/cli.ts (reported line 222)May include surrounding context.

ts

}
      console.log('');
    } else {
      console.log('No warnings. Article looks good for Qiita!');
      console.log('');
    }

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

1. Install dependencies

cd toolkit && npm install && npm run build && cd ..

2. Create shared config (recommended)

mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

md

### Publishing prerequisite

Before publishing, connect your Qiita account inside YouMind. The skill no longer reads `qiita.access_token` locally and should never ask the user to paste a Qiita token into this repo.

### Get a YouMind API Key

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 27)May include surrounding context.

cd toolkit && npm install && npm run build && cd ..

2. 创建共享配置

mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 27)May include surrounding context.

cd toolkit && npm install && npm run build && cd ..

2. 创建共享配置

mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill prominently advertises direct publishing and local file writes without an equally prominent warning that these actions can create persistent local artifacts and modify an external account. Users may invoke it expecting drafting help only, leading to unintended publication or sensitive content being stored on disk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

> **AI Qiita Article Writer installed!**
>
> Tell me your topic and I'll write and publish a Qiita article for you.
>
> **Try it now:** "Write a Qiita article about building CLI tools with TypeScript"
>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs writing article drafts to a shared home directory accessible to all YouMind skills, which creates cross-skill data exposure and persistent local storage of potentially sensitive unpublished content. In a multi-skill environment, other skills may read or misuse those drafts unless access boundaries and retention rules are clearly enforced.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

## Draft Location Rule

**Canonical:** write local article Markdown files to `~/.youmind/articles/qiita/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md).

**Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-qiita-article/output/<slug>.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

1. **Self-critique**: Pass all checklist items in the playbook's Step 6
2. **Conformance report**: Generate and present to user (Step 7/8)
3. **Image check**: Zero `cdn.gooo.ai` URLs in final body
4. **User approval**: Do not auto-publish without confirmation

### Result Links Rule

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest sets primary_language: "ja", and nearby fields such as the tagline and audience reinforce a fixed Japanese-language output. This is a natural-language locale constraint, but the file does not indicate that users can choose another language or explicitly opt in to Japanese-only behavior.

Content

No source excerpt is available for this finding.