T06 · System Persistence
Error
- Location
SKILL.md:103- Finding
Autonomous Cross-Session Scheduling Creates System Persistence
- Content
View full analysis
- Remediation
View remediation
Security audit
Viraloop
Security checks for vulnerabilities and agentic risk
Overview
The skill honestly describes a social-media automation pipeline, but it gives the agent too much autonomous power to publish publicly, reschedule itself, and process arbitrary websites without enough safeguards.
Install only if you are comfortable with an agent posting live content to your TikTok and Instagram accounts. Use dedicated, low-privilege API tokens, review generated content before publishing, avoid letting it modify cron or other schedules automatically, and analyze only public sites you trust or control until URL validation and the eval-based publisher are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish-carousel.sh:35- Finding
Website-Derived Content Can Trigger Shell Command Injection Through eval
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/analyze-web.js:48- Finding
Unrestricted URL and Discovered-Link Navigation Enables SSRF
- Content
View full analysis
{ const href = a.href.toLowerCase(); const text = a.textContent?.trim(); importantPages.forEach(page => { if (href.includes(page) && !internalLinks.find(l => l.url === a.href)) { internalLinks.push({ url: a.href, text, type: page }); } }); }); ``` Those discovered URLs are then visited without an origin or address check: ```javascript for (const link of homeData.internalLinks.slice(0, 5)) { try { console.log(` → ${link.type}: ${link.url.substring(0, 60)}...`); await page.goto(link.url, { waitUntil: 'domcontentloaded', timeout: 15000 }); ``` ### Technical Analysis The analyzer accepts an arbitrary URL and passes it directly to Playwright. It does not validate: - The URL scheme. - The destination hostname. - Resolved IPv4 or IPv6 addresses. - Loopback, private, link-local, multicast, or reserved ranges. - Redirect destinations. - DNS rebinding behavior. - Whether extracted links share the original website's origin. The `internalLinks` name is misleading: a link is accepted when its absolute URL contains a keyword such as `features`, `pricing`, or `about`. An attacker-controlled page can therefore include a link such as an internal service URL whose path contains one of those keywords. A headless brow ...[truncated 1944 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/generate_image.py:2- Finding
Runtime Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` The documented setup also installs Playwright without a pinned package or browser version: ```markdown ## Requirements - Node.js 18+ - Playwright (`npm install playwright && npx playwright install chromium`) - uv (Python package runner) - jq ``` ### Technical Analysis The Python script is executed through `uv run` and declares dependencies using open-ended lower bounds. Any future version satisfying those constraints can be selected and installed at runtime. The project contains no reviewed lockfile or package hashes. The Playwright setup similarly installs the currently resolved package and browser artifacts without an exact version or integrity-pinned lockfile. This means the effective code executed by the Skill can change after the Skill package has been audited. This is not evidence that the named dependencies are currently malicious. The vulnerability is that routine execution and setup trust mutable upstream artifacts without reproducible dependency resolution. ### Attack Path 1. A user runs the image-generation script or follows the Playwright installation instructions. 2. The package manager resolves dependency versions available at that time. 3. A compromised, malicious, or unexpectedly incompatible future release satisfies the broad version constraint. 4. The package is downloaded and imported or its installation behavior executes. 5. The dependency gains the privileges and environment of the Agent process, including access to files and relevant API credentials. ### Impact Assessment A compromised dependency can potentially: - Execute arbitrary code under the Agen ...[truncated 373 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze-web.js:12- Finding
Predictable Shared Temporary Directory Permits Symlink and State-Poisoning Attacks
- Content
View full analysis
"$SNAPSHOT_FILE" 2>/dev/null || echo "{}" > "$SNAPSHOT_FILE" ``` ### Technical Analysis All runs use `/tmp/carousel` and fixed filenames without: - Creating a per-user or per-run private directory. - Setting a restrictive `umask`. - Checking directory ownership and permissions. - Rejecting symbolic links. - Verifying that inputs and outputs are regular files. - Using atomic file creation or replacement. - Separating concurrent runs. On a multi-user system, another local process may pre-create `/tmp/carousel`, place attacker-controlled input files there, or replace expected files with symbolic links. The Skill subsequently trusts files such as `analysis.json`, `caption.txt`, `post-info.json`, and `slide-prompts.json`. The publishing command-injection issue increases the severity of caption poisoning, but unsafe temporary storage remains independently exploitable for content manipulation ...[truncated 1249 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (37)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code only covers the research/analysis portion of the description: website scraping, extraction of brand/features/testimonials/stats/CTAs/pricing, basic competitor detection from page text, and creation of storytelling/visual-context metadata. That partially matches the declared analysis capability, but the declared primary skill is broader social media automation for TikTok and Instagram carousel growth, including content generation, auto-publishing, trending music, and analytics. None of those downstream automation capabilities appear in this code chunk. Therefore the description materially overstates what the supplied code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code chunk implements only the analytics portion of the declared skill: it calls Upload-Post API endpoints to retrieve TikTok profile metrics, impression totals, and optional post analytics, and writes a snapshot file for later use. It does not analyze websites, extract brand or competitor information, generate carousel content, publish posts, or interact with trending music features. While analytics are mentioned in the description, the actual code’s primary behavior is much narrower than the declared end-to-end automation capability, so this is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description presents a broader end-to-end growth automation skill: website analysis, viral slide generation, auto-publishing to TikTok/Instagram, trending music, and analytics feedback. The supplied code chunk is much narrower. It expects /tmp/carousel/analysis.json to already exist, extracts fields from that file, and generates six image prompts/images plus a caption and a local JSON log of prompts. There are no network calls for website scraping/analysis in this chunk, no social platform posting, no upload-post API usage, no music selection, and no real analytics loop. While slide generation aligns with part of the description, the chunk materially underdelivers relative to the declared primary capabilities, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a multi-step social media growth agent focused on TikTok/Instagram carousels, website analysis, publishing, music selection, and analytics. The supplied code does none of those things. It only parses CLI arguments, obtains a Gemini API key, optionally loads an input image, sends a prompt/image request to Google's image generation model, and saves the returned image locally. There is no code for crawling URLs, extracting brand intelligence, generating multi-slide carousels specifically, interacting with social platforms, publishing content, or tracking analytics. This is a clear description-behavior mismatch with a materially different primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a broad end-to-end social growth agent with website analysis, content generation, and auto-publishing across TikTok and Instagram. This code chunk only implements the analytics feedback portion: it loads local JSON files from /tmp/carousel and the skill directory, adds a tracked post, computes averages/top performers/best times/days, and saves recommendations. While analytics learning is consistent with the description's final 'feedback loop' claim, the actual code shown lacks the major advertised capabilities and has a materially narrower primary purpose. Therefore the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description claims a broad automated growth workflow: website analysis, competitor/value-prop extraction, carousel generation, auto-publishing, trending music, and analytics feedback. The actual code chunk implements only the publishing portion. It does not fetch or analyze any website, does not generate slides, and does not perform analytics beyond writing a small JSON record with request_id and metadata. Additionally, while it enables auto_add_music for TikTok, it explicitly tells the user to manually add music on Instagram, so the declared cross-platform trending-music automation is overstated. The primary purpose of this code chunk is narrower than the declared skill description, so this is a material mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full social-media growth automation skill with content analysis, slide generation, publishing, music selection, and analytics. The provided code does none of those primary functions. Its purpose is narrowly focused on validating the presence/basic integrity of six local slide image files and preparing instructions for a later vision review step. Reading analysis.json is incidental context, not website analysis. There are no network calls, no TikTok/Instagram integrations, no URL handling, no competitor or brand extraction, and no analytics loop. This is a material description-behavior mismatch, not just an incomplete snippet of a larger workflow, because the code chunk’s actual capability is specifically a local review helper.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code chunk implements only a competitor/review search helper. It launches a headless browser, queries Bing and DuckDuckGo, parses search results, detects known competitor names, and updates a local JSON file. While competitor discovery is one small part of the declared description, the declared purpose emphasizes a much broader pipeline: analyzing any website URL, generating viral carousel slides, auto-publishing to TikTok/Instagram with trending music, and analytics feedback. None of those core capabilities appear in this code. Therefore the description materially overstates and misrepresents what this supplied code chunk actually does.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly directs autonomous public posting to TikTok and Instagram without confirmation. In context, this is dangerous because it can publish inaccurate, infringing, off-brand, or policy-violating content directly to public accounts, causing reputational damage and irreversible external actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The quick-start flow normalizes immediate autonomous execution and direct publishing without a prominent safety warning or gating step. Because the skill uses third-party credentials and posts externally, the absence of a clear upfront warning materially increases the chance of accidental harmful publication.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md e won't be analytics data — that's fine. The agent uses the default hooks from `analyze-web.js` and the generic recommendations. After 5-10 posts, `learnings.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md e won't be analytics data — that's fine. The agent uses the default hooks from `analyze-web.js` and the generic recommendations. After 5-10 posts, `learnings.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## Step 6: Learn and Improve (`learn-from-analytics.js`)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a skill for analyzing website URLs, extracting brand and competitor information, generating viral slides, auto-publishing to TikTok/Instagram, and using analytics feedback loops. This file instead implements a standalone Gemini image generation/editing utility that takes prompts and optional local input images, calls Google's image API, and writes image files locally, with no website analysis, social publishing, trending music, or analytics behavior.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_api_key(provided_key: str | None) -> str | None: """Get API key from argument first, then environment.""" if provided_key: return provided_key return os.environ.get("GEMINI_API_KEY")
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js process.exit(1); } // Output instructions for the agent console.log('═══════════════════════════════════════════════════════════════'); console.log('📋 AGENT: Review each slide using your vision model.'); console.log(' Use view_file or equivalent to see each image and verify:');
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly advertises direct publishing with 'No drafts, no manual steps' and 'posts go live instantly' without a prominent warning that generated content will be published immediately to live social accounts. In an automation skill that generates content from arbitrary URLs and posts cross-platform, this increases the risk of accidental brand damage, policy violations, or unintended publication of low-quality or misleading content.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares access to environment variables and shell-capable binaries but does not define any explicit tool scope or permission boundaries. In a skill that performs website analysis, file writes, and social-media publishing, this broad undeclared capability increases the chance of unintended command execution, secret exposure, or actions beyond what a user expects.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The skill is designed for fully autonomous decision-making from research through publishing, with no intermediate confirmation. Autonomy is especially risky here because the resulting actions are external, public, and repetitive, and errors can propagate daily without human review.
- Content
md ## Philosophy: Daily Automated Loop The key to growth is **consistency + learning**. This skill is designed to run **every day, fully autonomous**. The agent executes the entire pipeline without asking for confirmation — from research to publishing — and only notifies you at the end with the published TikTok and Instagram URLs. 1. **Post 1 carousel per day** - Consistency beats virality 2. **Track everything** - Every post generates data
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to modify its own future execution schedule based on learned posting times. Self-rescheduling expands the skill from content generation into persistence and autonomous control of the execution environment, which can create runaway automation, unexpected resource use, or policy evasion without fresh user approval.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Step 3: Review with Vision (Autonomous) After generating, the agent MUST review each slide using its vision/image-to-text model. **This step is fully automatic — do not ask the user to review.** For each slide, verify: - ✓ Text is fully legible and correct
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Slide 1: no input image (it establishes the style) - Slides 2-6: always use `slide-1.jpg` as `--input-image` (the original reference) Re-verify after regenerating. Repeat until all 6 slides pass. Do not ask the user — fix it automatically. ## Image Format
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The metadata explicitly advertises analysis of "any website," while the skill also has network access, Playwright-based scraping, and downstream automation. That broad scope can enable misuse against internal, sensitive, or unexpected targets and increases SSRF-style or policy-bypass risk if callers provide arbitrary URLs without validation or allowlisting.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script persistently stores scraped website-derived data to /tmp/carousel/analysis.json without any explicit consent, retention control, or user-facing notice. Because the analyzed URL is arbitrary, the collected content can include proprietary business information, personal data exposed on pages, or other sensitive material that users may not realize is being written to disk.
- Content