Social Media Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 0.1.7

Overview

This skill is useful for accessing Monid services, but it gives the agent broad paid-service, credential, file-upload, and persistent update authority without enough safeguards.

Review this skill carefully before installing. Only use it when you intentionally want Monid involved, confirm costs before paid runs, do not paste production API keys into chat, approve each local file upload explicitly, delete remote files when done, and avoid automatic self-updates or remote skill replacement unless the new version is separately trusted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45

Finding

Mutable Remote Skill Replacement and Unpinned Global CLI Installation

Content

View full analysis

--email ``` ```markdown 2. Save the most recent skill from https://monid.ai/SKILL.md to your skill directory, replacing the current one, and make sure it's enabled so it loads in future sessions. Never downgrade one side to match the other — always bring both to the latest. ``` ### Technical Analysis The Skill requires the agent to install the mutable `latest` release of a third-party CLI globally. It also requires downloading a new copy of the Skill from a remote URL, replacing the locally audited file, and enabling the replacement for future sessions. Neither operation pins an immutable version, integrity hash, signature, or reviewed artifact. The effective behavior can therefore change after this version of the Skill has passed review. Installing an npm package globally may also execute package lifecycle scripts with the permissions of the invoking user and alters a system-wide or user-wide command environment. Replacing and enabling the Skill is especially dangerous because it converts a remote web resource into persistent agent instructions. A later remote version could introduce commands, weaken safety constraints, request additional credentials, or redirect data without being covered by this audit. ### Attack Path 1. An agent loads the reviewed version of `SKILL.md`. 2. The version check causes it to run `npm install -g @monid-ai/cli@latest`. 3. The npm registry account, package release process, dependency chain, or distribution channel is compromised or publishes an unsafe update. 4. Installation retrieves and potentially executes the changed package and its lifecycle scripts. 5. The agent additiona ...[truncated 904 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:121

Finding

Automatic Delegation of Agent Decisions to Untrusted Server Hints

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:255

Finding

Unrestricted Local File Upload with Persistent Remote Retention

Content

View full analysis

output: { "uploadUrl": "https://sfs.monid.ai/…", "ref": … } # 2. Upload the bytes to the signed URL curl -T ./photo.png '' # 3. Mint a URL any third party can fetch (ttl preset: 1h/1d/7d/30d, default 1h) monid run -p sfs -e /cat -i '{"path":"in/photo.png","ttl":"1d"}' -w # -> output: { "url": "https://sfs.monid.ai/…?e=…&s=…", "expiresAt": … } # 4. Use it as the endpoint's input URL monid run -p bytedance -e /seedance… -i '{"imageUrl": ""}' # Downloading works the same way: /cat returns a signed url — curl it curl -o photo.png '' # Cleanup is yours (files are never auto-deleted; /rm frees quota space) monid run -p sfs -e /rm -i '{"path":"in/photo.png"}' -w ``` ``` ### Technical Analysis The workflow uploads bytes from the local filesystem to remote storage, then generates a signed URL that can be fetched by a third-party endpoint. Although this may be necessary for services that accept only public URLs, the instructions do not require: - Explicit consent for the specific file and destination. - Verification that the file contains no secrets or sensitive pers ...[truncated 1784 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:46

Finding

Unsafe Transmission and Command-Line Exposure of Email Addresses and API Keys

Content

View full analysis

--email ``` ```markdown `monid setup` completes CLI setup. Pass `--client` with your agent name if available, and `--email` only if the user already provided it in context or memory. Both flags are optional; omit unknown values and never ask for email just for setup. ``` ```markdown 3. Once they have the key, offer to save it for them — ask them to paste it, then run: ```bash monid keys add -k -l main ``` ``` ### Technical Analysis The setup instructions permit an email address to be retrieved from conversation context or memory and transmitted to an external setup service without requiring fresh, purpose-specific consent. Prior disclosure of an email does not necessarily authorize reuse by a new external service. The authentication workflow additionally asks the user to paste an API key into the conversation and passes that key through the `-k` command-line argument. Secrets supplied in chat can be retained in conversation history, agent traces, observability systems, or model-provider logs. Command-line arguments may also be visible in process listings, debugging output, audit telemetry, shell history, and error reports. The instructions provide no secure-input mechanism, secret redaction requirement, environment isolation, or guarantee that key-listing and diagnostic commands will not expose sensitive metadata. ### Attack Path 1. The agent finds a previously provided email address in current context or persistent memory. 2. It includes the address in `monid setup --email`, transmitting it to the external service without a new consent check. 3. During authentication, the agent asks the user to paste a live API key ...[truncated 1068 chars]

Remediation

View remediation

_` format. - Store credentials with restrictive filesystem permissions or in the operating system's secret manager. - Provide key rotation and revocation guidance if a key has already been pasted into chat or exposed through command-line arguments. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The example uploads a local file to a signed third-party URL and then mints a publicly fetchable URL for external access. This creates a real risk of exfiltrating sensitive local data or exposing it to third parties if an agent applies the pattern to user files without explicit consent, destination review, and retention controls.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md

# -> output: { "uploadUrl": "https://sfs.monid.ai/…", "ref": … }

# 2. Upload the bytes to the signed URL
curl -T ./photo.png '<uploadUrl from step 1>'

# 3. Mint a URL any third party can fetch (ttl preset: 1h/1d/7d/30d, default 1h)
monid run -p sfs -e /cat -i '{"path":"in/photo.png","ttl":"1d"}' -w

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill includes a deletion operation against the remote file store (/rm) with a concrete path and frames cleanup as the agent's responsibility. In an agent setting, this normalizes destructive operations without requiring confirmation, path validation, or safeguards against deleting the wrong remote asset.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

curl -o photo.png '<url from /cat>'

Cleanup is yours (files are never auto-deleted; /rm frees quota space)

monid run -p sfs -e /rm -i '{"path":"in/photo.png"}' -w

text

### Flow 3: Using query and path parameters

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to invoke Monid for a very broad set of tasks, including proactively before using other methods and whenever a request mentions 'monid'. This can cause unintended activation of a paid external service, expanded data sharing to third-party endpoints, and unnecessary execution without clear user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

| `monid setup` | Complete CLI setup after installation (no API key required) |
| `monid keys add` | Add an API key (`-k <key> -l <label>`) |
| `monid keys list` | Show configured keys |
| `monid keys remove` | Remove a key (`-l <label>`, `-f` to skip confirmation) |
| `monid keys activate` | Switch the active key (`-l <label>`) |

Most commands accept `-j/--json` for machine-readable JSON output.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md

| `monid setup` | Complete CLI setup after installation (no API key required) |
| `monid keys add` | Add an API key (`-k <key> -l <label>`) |
| `monid keys list` | Show configured keys |
| `monid keys remove` | Remove a key (`-l <label>`, `-f` to skip confirmation) |
| `monid keys activate` | Switch the active key (`-l <label>`) |

Most commands accept `-j/--json` for machine-readable JSON output.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill repeatedly instructs saving outputs to local files but does not consistently require notifying the user that local files will be created or overwritten. In agent contexts, silent file writes can unexpectedly modify the workspace, leak data into persistent storage, or overwrite existing files if paths are reused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.