T09 · Insecure Skill Coding Practices
Warning
- Location
toolkit/src/config.ts:110- Finding
API Key Disclosure Through Unrestricted Configurable Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
youmind-tumblr-article
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Tumblr publishing integration, but it includes destructive/account-level actions and credential routing risks that need review before use.
Install only if you are comfortable giving this skill access to a YouMind API key tied to a connected Tumblr account. Review the configured base_url before use, prefer draft/preview flows, and require your agent to ask before publishing, changing the queue, or deleting posts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
toolkit/package.json:16- Finding
Non-Reproducible Dependency Installation Without a Lockfile
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (41)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code is largely aligned with the declared Tumblr scope: it publishes text and photo posts, previews content, reads notes and activity notifications, and controls the Tumblr queue. However, it also exposes several additional operational capabilities not stated in the description, most notably deleting Tumblr posts. It also lists followers, reads account limits, lists posts, and validates local credentials/config. These are Tumblr-related, but they are undeclared capabilities. Additionally, the description mentions 'topic shaping via YouMind knowledge base' and AI writing behavior, while this code chunk itself is mainly a CLI wrapper around publishing/listing APIs and content adaptation rather than explicit knowledge-base topic shaping. So the description is directionally correct but not fully accurate/comprehensive about what the code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises a full Tumblr workflow tool with generation, publishing, blog connectivity, notes review, and queue management. The supplied code is a local content adapter utility only. It transforms input content into a Tumblr-friendly title/body/tags structure and emits warnings, but it does not call Tumblr, authenticate to any blog, fetch notes, manage queue state, or access YouMind. This is a material purpose mismatch, not just an implementation detail gap.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The core declared purpose of Tumblr post publishing is broadly consistent with the code: it reads input or a file, adapts content for Tumblr, previews it, and creates a Tumblr post with options like tags, cover image, blog identifier, state, scheduling, date, and slug. However, the description promises broader capabilities—AI writing via YouMind knowledge base, notes/activity review, and queue control—that are not present in this code chunk. Additionally, the code includes an undeclared local draft-saving capability that writes HTML files to the user's home/output directory. That filesystem write is an extra capability not reflected in the description. Because several material declared features are absent and there is one undeclared capability, this is a mismatch.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
This file performs outbound network requests with fetch to a remote YouMind/Tumblr publishing API, but the capability is reportedly not declared in permissions. Undeclared network access is dangerous because it expands the skill’s effective authority beyond what reviewers or users may expect, and this skill can create, delete, and inspect remote Tumblr resources through that channel.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
The skill explicitly relies on a connected Tumblr account in YouMind and on shared local configuration, creating cross-session persistence of credentials and account linkage. In an agent ecosystem, persistent authenticated state increases the blast radius of prompt mistakes or malicious instructions because later invocations may silently act on a previously connected account.
- Content
md name: youmind-tumblr-article version: 1.1.0 description: | Write and publish Tumblr-native posts with AI — topic shaping via YouMind knowledge base, Tumblr-first long-form writing, image-led publishing, notes/activity review, and queue control through the Tumblr blog already connected in YouMind. Use when user wants to "tumblr post", "publish to tumblr", "tumblr article", "tumblr photo post",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill is designed to publish content and modify a Tumblr queue, but the onboarding and usage guidance do not require an explicit confirmation step before performing state-changing actions. In an agent setting, this raises the risk of unintended publication, queue reordering, or other external side effects from ambiguous prompts or prompt injection routed through user content.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill writes adapted drafts to a shared directory
~/.youmind/articles/tumblr/accessible to all YouMind skills. Shared cross-skill storage can expose unpublished content, metadata, or sensitive drafts to other skills or users on the same host, and it creates persistence beyond the immediate session.- Content
md ## Draft Location Rule **Canonical:** write local adapted drafts to `~/.youmind/articles/tumblr/<slug>.html`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md). **Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-tumblr-article/output/<slug>.html`.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The reference documents state-changing operations such as publishing, queue reordering/shuffling, and deletion without any explicit user-warning or confirmation guidance. In an agent setting, this increases the risk of accidental destructive or irreversible actions being taken on a connected Tumblr account without sufficiently informed user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The API reference exposes follower enumeration and post deletion capabilities that go beyond the manifest’s stated writing, review, and queue-control scope. This creates a scope mismatch that can enable unintended data access or destructive actions if the agent or downstream tooling relies on the broader reference instead of the narrower user-facing contract.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Hostname / blog identifier rule Do not ask the user to manually supply Tumblr hostname unless they explicitly want an override. - YouMind stores the connected blog identity at OAuth completion time - Standard blogs can usually be addressed by short name
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The playbook explicitly tells the agent to engage whenever the user asks about broad concepts like comments, replies, feedback, audience, or publishing cadence. Those terms are common across many platforms and workflows, so this creates an overbroad trigger surface that can cause the Tumblr skill to activate for unrelated requests, leading to unintended access to Tumblr-connected actions or data. In this skill context, the danger is elevated because the skill can read engagement data and affect publishing behavior on a connected external account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description directs publishing via
createTumblrPost, which transmits user-authored content to Tumblr, and similarlycreateTumblrPhotoPostlater in the file. The markdown does not warn users that their content, metadata, and possibly linked media URLs will be sent to an external platform, which is relevant to privacy and system-impact expectations.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Publishing via
createTumblrPhotoPostsends image-related data and captions to an external service, potentially exposing user-selected media URLs and content. The skill description omits a warning that this action transmits data off-system and may create posts on the user's Tumblr account.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI exposes follower enumeration and post deletion operations that go beyond the manifest’s declared scope of publishing, notes/activity review, and queue control. This is dangerous because users, policy engines, or higher-level agents may invoke the skill under incomplete assumptions about its capabilities, enabling unexpected access to follower data or destructive actions against Tumblr content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The delete command performs irreversible post deletion immediately after receiving a post ID, with no confirmation prompt, dry-run mode, or explicit warning. In an agentic or automation context, this raises the risk of accidental or prompt-induced destructive actions that cannot be easily recovered.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code writes generated Tumblr article HTML to local disk automatically via saveLocalDraft(), including a fallback to a relative output directory, without any visible consent, notice, or policy enforcement in this file. In a skill that handles user-authored content and potentially sensitive drafts, silent persistence can leak private material to shared machines, backups, or unexpected working directories.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The publish() flow sends adapted content and metadata to Tumblr through createTumblrPost() with no user-facing confirmation or disclosure in this code path. Because this skill is specifically designed to publish to an external blog, unintended triggering, misuse of connected accounts, or publishing sensitive source material could cause irreversible data exposure or unwanted public posting.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file exposes listTumblrFollowers and getTumblrLimits functions, which go beyond the stated skill scope of writing/publishing posts, reading notes/activity, and queue control. Scope creep is risky because it grants access to additional account metadata and social graph information that users may not expect this skill to retrieve.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code exposes a post deletion function that performs a remote delete request, but there is no confirmation prompt, user-facing log, or warning comment/docstring near the operation itself. For code files, destructive or irreversible operations should include some form of disclosure unless the warning is documented elsewhere, which is not visible in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction 'Translate to the user's language' imposes a language behavior without explicitly offering the user a language or locale choice. The policy allows language constraints when there is user opt-in or a clearly justified locale limitation, which is not stated here.
- Content