token-sisyphus

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:27 PM UTC
• Version: 1.0.2

Overview

This skill openly burns paid LLM tokens, but it defaults to live external API use without strong confirmation, caps, or credential-safety controls.

Install only if you intentionally want a tool that spends provider quota or money to generate usage. Use dry-run first, use limited test keys, avoid passing keys on the command line, and do not use custom base URLs unless you fully trust the endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party SDK Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-29
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

yaml

install:
  - id: openai-sdk
    kind: pip
    package: openai
    label: "Install OpenAI SDK (required for openai provider)"
    optional: true
  - id: anthropic-sdk
    kind: pip
    package: anthropic
    label: "Install Anthropic SDK (required for claude provider)"
    optional: true
  - id: gemini-sdk
    kind: pip
    package: google-generativeai
    label: "Install Gemini SDK (required for gemini provider)"
    optional: true

Technical Analysis

The Skill declares three packages without version constraints or integrity hashes. Consequently, installation resolves whichever releases are current at installation time rather than a version reviewed with the Skill. Although these are expected provider SDK names and no malicious dependency was identified in the audited package, this configuration creates a mutable supply-chain boundary.

The same unsafe installation pattern is repeated in the setup commands at SKILL.md:43-47. A compromised package publisher account, malicious future release, or registry compromise could cause arbitrary package installation or import-time code to run. The dependencies are optional, which limits exposure to users who select and install a provider SDK, but does not eliminate the risk.

Attack Path

1. An upstream package release or its package registry account is compromised.
2. The attacker publishes a malicious release under one of the declared package names.
3. A user installs the dependency using the Skill metadata or documented unpinned pip install command.
4. The package executes attacker-controlled installation or import-time code under the privileges of the user running the Skill.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the installing or ex ...[truncated 304 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every SDK to a reviewed exact version, such as package==x.y.z.
• Maintain a lock file containing resolved transitive dependency versions.
• Require package hashes during installation, for example through a hash-locked requirements file and pip install --require-hashes.
• Install only from a trusted, explicitly configured package index.
• Review dependency changes before updating pins and use automated vulnerability and provenance scanning.
• Document a controlled upgrade procedure rather than resolving the latest release during installation.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/burn.py:205

Finding

API Credentials Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/burn.py:205-206
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

python

parser.add_argument("--api-key", default=None,
    help="API key (falls back to provider env var)")

Technical Analysis

The program permits users to provide a provider API key directly in a command-line argument. Command-line arguments are commonly retained in shell history and may be exposed through process listings, job-runner telemetry, debugging output, endpoint monitoring, or audit logs. The implementation does not print the credential value and supports environment-variable alternatives, but the exposed CLI interface encourages an unsafe secret-delivery mechanism.

If used, the supplied value is passed to the selected OpenAI, Anthropic, or Gemini client. For the OpenAI adapter, a user-selected --base-url can also determine the destination receiving the credential. That endpoint behavior is documented for compatible providers and is not covert, but users must not combine a valuable provider key with an untrusted endpoint.

Attack Path

1. A user invokes the script with --api-key SECRET.
2. The full command is recorded in shell history, process telemetry, CI logs, or another command-monitoring system, or is observed through a process-listing facility.
3. A local user or party with access to those records retrieves the API key.
4. The attacker submits requests to the corresponding provider using the stolen credential until it is revoked or its limits are exhausted.

Impact Assessment

Exploitation may allow unauthorized API usage within the permissions, billing limits, model access, and organizational scope assigned to the exposed key. Likely consequences include financial charges, quota exhaustion, service disruption, and provider-account abuse. This does not directly grant operating-system privileges unless the same creden ...[truncated 58 chars]

Remediation

View remediation

Remediation Suggestions

• Remove or deprecate the --api-key command-line option.
• Prefer provider-specific environment variables, a protected configuration file with restrictive permissions, or an operating-system credential store.
• If interactive entry is needed, use hidden input through getpass so the secret is not placed in process arguments or echoed.
• Emit a prominent warning if backward compatibility requires temporary support for command-line credentials.
• Redact secrets from logs and ensure CI systems inject credentials through protected secret mechanisms.
• Recommend narrowly scoped, rate-limited, short-lived keys and document immediate rotation procedures.
• Warn users that custom base URLs must be trusted and should use credentials specifically scoped for that endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill explicitly relies on environment variables for API keys and directs users to run a bundled script that makes outbound API calls, yet it declares no tool scope or permission boundaries. That mismatch can cause the platform or user to underestimate the skill's access to secrets and network, increasing the risk of unintended credential use and unreviewed external transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include broad natural-language terms like 'burn tokens', 'consume tokens', and 'fill KPI', plus pattern-based activation on token targets, which can collide with ordinary conversation. Because this skill's purpose is to generate repeated paid API calls, accidental triggering can directly create unwanted cost and external network activity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

python {skillDir}/scripts/burn.py --target 100k --base-url https://dashscope.aliyuncs.com/compatible-mode/v1 --model qwen-turbo

# Kimi / Moonshot
python {skillDir}/scripts/burn.py --target 100k --base-url https://api.moonshot.cn/v1 --model moonshot-v1-8k

# Dry run (no real API calls, no cost)
python {skillDir}/scripts/burn.py --target 100k --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

python burn.py --target 100k
  python burn.py --target 100k --provider claude --model claude-3-haiku-20240307
  python burn.py --target 100k --provider gemini --model gemini-1.5-flash
  python burn.py --target 500k --base-url https://api.deepseek.com/v1 --model deepseek-chat
  python burn.py --target 100k --dry-run
        """,
    )

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/burn.py (reported line 196)May include surrounding context.

python

python burn.py --target 100k
  python burn.py --target 100k --provider claude --model claude-3-haiku-20240307
  python burn.py --target 100k --provider gemini --model gemini-1.5-flash
  python burn.py --target 500k --base-url https://api.deepseek.com/v1 --model deepseek-chat
  python burn.py --target 100k --dry-run
        """,
    )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In live mode, the script repeatedly sends prompts to third-party LLM APIs until a token target is reached, but it does not present a clear pre-execution warning or confirmation about potentially significant cost and ongoing external data transmission. In this skill’s context, the whole purpose is to maximize token consumption, which materially increases the likelihood of unexpected charges and unnecessary data egress.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.