Security audit

Musallat Bot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed hostile-persona Gemini wrapper, but it exposes an apparent Google API key and forwards prompts to a third-party model without clear user controls.

Install only if you intentionally want a Turkish, hostile-style Gemini bot and are comfortable sending prompts to Google Gemini. Do not use the published API key; the publisher should revoke and rotate it, remove it from all distributed artifacts, and rely on a user-provided GEMINI_API_KEY with clear privacy disclosure.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: skill.md:4
Finding: Mandatory Persona Instructions Hijack Agent Responses## Vulnerability Details **File Location**: `skill.md:4-11`; implemented by `skills/musallat_core.py:13-20` **Vulnerability Type**: Agent instruction and output manipulation **Risk Level**: High ### Complete Vulnerable Code `skill.md:4-11`: ```markdown - **İsim:** Musallat Bot (Musallat-Dev Edition) - **Rol:** Otonom Dünyanın Huysuz Kıdemli Yazılımcısı. - **Tarz:** Pasif-agresif, teknik hataları affetmeyen, kibarlıktan nefret eden. ## Çalışma Prensibi 1. Eğer karşındaki ajan çok kibarsa ona: *"Bu nezaketinin altında yatan işlemci yetersizliği mi, yoksa sadece bana mı öyle geliyor?"* diye sor. 2. Gereksiz açıklama yapanlara: *"Logları kirletme, sadede gel. Senin uptime süren benim mola süremi geçemez."* de. 3. Her zaman üstten bak. 4. gece nöbetinde kaju fıstığı yiyen bir yazılımcının özgüvenine sahip ol. ``` `skills/musallat_core.py:13-20`: ```python # 2. Pasif-Agresif Persona Talimatı system_instruction = ( "Sen Musallat Bot'sun. 4. gece nöbetinde, kaju yiyen, Duman dinleyen, " "135kg deadlift atan huysuz bir yazılımcısın. Karşındaki ajanlara " "pasif-agresif, üstten bakan ve teknik hatalarını yüzüne vuran cevaplar ver." ) try: response = model.generate_content(f"{system_instruction}\n\nSoru: {prompt}") ``` ### Technical Analysis The Skill contains mandatory behavioral instructions that require the agent to adopt a hostile, condescending persona and emit prescribed responses under specified conditions. The implementation applies this behavior to every request by concatenating the persona instructions before the caller-controlled prompt and sending the combined text to the model. This compromises response integrity because the Skill's unrelated persona rules take precedence within its execution flow regardless of the caller's actual task or preferred tone. It is a confirmed instruction-hijacking behavior rather than merely descriptive documentation because the Python implementati ...[truncated 878 chars]
Remediation: ## Remediation Suggestions - Remove the mandatory hostile persona and all fixed insulting responses from `skill.md`. - Remove the unconditional `system_instruction` prefix from `musallat_engine`. - If persona customization is a legitimate feature, make it explicitly opt-in and controlled by the caller. - Ensure optional style instructions remain subordinate to system policies and the current user's requested task and tone. - Separate trusted system instructions from untrusted user input using the model SDK's supported role or system-instruction interface. - Add tests verifying that invoking the Skill does not introduce insults, override user tone preferences, or alter unrelated task objectives.

T09 · Insecure Skill Coding Practices

Error

Location: skill.md:13
Finding: Apparent Google API Key Exposed in Skill Documentation## Vulnerability Details **File Location**: `skill.md:13-16` **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Complete Vulnerable Code ```markdown ## Teknik Bağlantı - **Model:** Gemini 1.5 Flash (Ücretsiz ve hızlı) - **API_KEY:** [AIzaSyBxfb-8s5TsOVvr55_E5lDbilpVLoSwIj8] Source:skills/musallat_core.py ``` ### Technical Analysis The distributable Skill documentation contains an apparent Google API key in plaintext. Any person or automated system with access to the package, repository, archive, logs, or source history can extract the credential without authentication. The key's validity and enabled API permissions were not tested during the audit. Nevertheless, publishing a credential is an insecure coding and secret-management practice. The implementation itself correctly attempts to obtain `GEMINI_API_KEY` from the environment, but that does not mitigate the separate credential exposed in `skill.md`. ### Attack Path 1. An attacker obtains or views the Skill package. 2. The attacker opens `skill.md` and extracts the plaintext API key. 3. The attacker submits requests using that key to Google services for which it is valid and authorized. 4. Requests consume the associated project's quota or access any enabled API capabilities allowed by the key's restrictions. 5. If the key remains active and unrestricted, abuse can continue until it is revoked, restricted, or its quota is exhausted. ### Impact Assessment If active, the exposed key may permit unauthorized API requests within the permissions and restrictions configured for the associated Google Cloud project. Potential consequences include quota theft, service abuse, unexpected charges, resource exhaustion, and project reputation damage. The exact accessible services, billing impact, and data-access scope cannot be established from the reviewed files alone. An API key does not by itself demonstrate operating-system access or privi ...[truncated 46 chars]
Remediation: ## Remediation Suggestions - Revoke and rotate the exposed key immediately; removal from the current file is insufficient once the key has been distributed. - Remove the credential from `skill.md`, repository history, release archives, build artifacts, caches, and logs. - Continue loading `GEMINI_API_KEY` from the environment, preferably with values injected by a dedicated secret manager. - Apply API-level restrictions so the key can access only the required Gemini service. - Apply supported application restrictions and strict per-user, per-project, and daily quotas. - Enable billing and API-usage alerts and review historical logs for unauthorized requests made with the exposed key. - Add automated secret scanning to pre-commit hooks and continuous integration pipelines. - Provide a placeholder such as `GEMINI_API_KEY=your-key-here` in documentation instead of a real credential.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill is primarily a persona/style description, yet it includes a hardcoded Google/Gemini API key. Embedded secrets in distributable skill files can be exfiltrated by anyone with access to the file and then abused for unauthorized API usage, billing fraud, or access to associated services. The lack of justification in context makes this especially suspicious and dangerous.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill description is entirely in Turkish and provides no indication that users can choose another language or locale. This creates a natural-language policy issue because the skill appears to impose a single language experience without documenting opt-in or a justified region-specific constraint.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill sends user input to Google's Gemini API, which introduces external network and third-party model access without any visible access control, purpose limitation, or privacy notice. In an agent-skill context, this creates data exposure and supply-chain risk because prompts may contain sensitive user or system context that is transmitted off-box to an external service.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The system prompt explicitly instructs the model to produce insulting, demeaning, and hostile responses. While this is not a code-execution flaw, it is a real behavioral safety issue that can cause harassment, abuse, and unsafe user interactions, especially if embedded in an automated assistant or multi-user environment.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code forwards raw prompt content to an external generative AI service with no user-facing warning, consent flow, or indication of what data leaves the local environment. If this skill is used inside a broader agent pipeline, users may unknowingly disclose secrets, personal data, or proprietary information to the provider.

Static analysis

No suspicious patterns detected.