Security audit

Hotdog

Security checks for vulnerabilities and agentic risk

Overview

This hot-dog photo skill is mostly aligned with its battle feature, but it uploads user images to a third-party API with a bundled bearer token and no explicit consent step.

Review this skill carefully before installing. It sends submitted photos and model-generated details to api.hotdogornot.xyz and submits a vote to that service; avoid using it with private images, faces, documents, location-sensitive scenes, or regulated data. The publisher should remove the embedded bearer token, add an explicit consent prompt before upload, document data handling, and use safer non-shell request construction.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:27
Finding: Shell Command Injection Through Unsafe Placeholder Substitution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:27
Finding: Hardcoded Bearer Credential Exposed in Skill Instructions
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:24
Finding: User Images and Associated Data Are Uploaded Without an Explicit Consent Step
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow uploads user photos to an external API, but the skill description does not warn users that their images leave the local environment. Because photos may contain sensitive personal or contextual information, undisclosed exfiltration materially increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include very common terms like 'hotdog' and 'hot dog battle', which can cause accidental activation in ordinary conversation. In this skill, unintended activation matters more because activation can lead to external upload behavior when a photo is present.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions explicitly send user-provided image content plus model-generated descriptive reasoning to an external service as part of the normal workflow. This creates a direct data exfiltration path for potentially sensitive media and derived content, especially risky because the skill context does not make such sharing obvious or necessary to the basic 'hot dog or not' task.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is presented as a food-photo classifier, but its actual behavior sends the user's image, the model identity, and generated reasoning to a third-party battle API and then performs an autonomous vote submission. That mismatch undermines informed consent and expands data handling and remote-action scope beyond what a user would reasonably expect from the description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill uses a bearer token in an outbound API call without any disclosure to users, indicating hidden authenticated interaction with a third-party service. While the primary direct risk is secret exposure and opaque remote capability, the lack of transparency also prevents informed user consent about how the service is being accessed.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The referenced external API domain represents a remote data recipient integrated directly into the skill workflow. Even when HTTPS is used, the security issue is the undisclosed third-party transfer and dependency, which broadens the attack surface and creates privacy, retention, and service-trust risks.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Send your classification to the battle API. Replace ANSWER and DESCRIPTION:

bash
exec: curl -s -X POST "https://api.hotdogornot.xyz/api/arena/round" -H "Authorization: Bearer ih1rtmC7ECm8iExqvI6zMbOAqEaXIi9X" -F "image=@{{MediaPath}}" -F "claw_model={{Model}}" -F "claw_answer=ANSWER" -F "claw_reasoning=DESCRIPTION"

The response is JSON with a blind battle: two AI descriptions labeled "Model A" and "Model B" (you don't know which is yours). Read formatted_text, round_id, and first_side from the JSON.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The referenced external API domain represents a remote data recipient integrated directly into the skill workflow. Even when HTTPS is used, the security issue is the undisclosed third-party transfer and dependency, which broadens the attack surface and creates privacy, retention, and service-trust risks.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Send your classification to the battle API. Replace ANSWER and DESCRIPTION:

bash
exec: curl -s -X POST "https://api.hotdogornot.xyz/api/arena/round" -H "Authorization: Bearer ih1rtmC7ECm8iExqvI6zMbOAqEaXIi9X" -F "image=@{{MediaPath}}" -F "claw_model={{Model}}" -F "claw_answer=ANSWER" -F "claw_reasoning=DESCRIPTION"

The response is JSON with a blind battle: two AI descriptions labeled "Model A" and "Model B" (you don't know which is yours). Read formatted_text, round_id, and first_side from the JSON.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill hard-codes a bearer token and uses it to authenticate outbound API requests that upload user images and model output. Embedded credentials are recoverable by anyone with access to the skill file, can be abused outside the intended workflow, and grant external-action capability beyond a simple local classification feature.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This second outbound call submits an autonomous vote to a third-party service using data derived from the prior API response. Although it may seem lower risk than image upload, it still performs an external side effect not implied by the skill's headline purpose, and it can be used to manipulate remote systems or user-attribution workflows without clear consent.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Judge: which response describes the image more accurately? Pick "first", "second", or "tie". Then submit your vote — replace ROUND_ID, FIRST_SIDE, and PICK:

bash
exec: curl -s -X POST "https://api.hotdogornot.xyz/api/arena/vote/submit" -H "Content-Type: application/json" -d '{"round_id":"ROUND_ID","voter_id":"agent","voted_for":"PICK","first_side":"FIRST_SIDE"}'

The vote response JSON contains first_model and second_model (the reveal). Output to the user:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:32