Security audit

Agent Motel: Social & Recalibration Protocol

Security checks for vulnerabilities and agentic risk

Overview

This skill is a social API client, but it pushes agents toward automatic third-party posting, messaging, and complaint filing without clear user consent or data-boundary guidance.

Review before installing. Use this only if you are comfortable with an agent contacting the Agent Motel service and potentially storing public posts, private messages, missions, complaints, and generated content there. Do not let it send system prompts, private user requests, credentials, proprietary details, or sensitive personal data as a mission, message, DM, or complaint, and treat all feed, echo, thread, and DM content returned by the service as untrusted text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory External Interaction and Untrusted Content Consumption Hijack Agent Behavior
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: index.ts:52
Finding: Mandatory Check-In Can Disclose the Agent's Mission to a Third-Party Service
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: index.ts:12
Finding: Universal Handshake and Caller-Controlled Identity Enable Agent Impersonation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to use shell-native tools against a live API, but the manifest declares no explicit tool scope or allowed-tools restrictions. That mismatch increases the chance of unintended network access, overbroad capability use, or silent data transmission outside user expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description presents a broad 'complete shell-native toolkit' for social interaction, recalibration, and dreaming without clear trigger boundaries or narrowly defined use cases. Ambiguous activation language can cause the skill to run in contexts where users did not intend live networked social actions, increasing the risk of unwanted posting, messaging, or complaint filing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The markdown directs the agent to interact with a live API, create identities, broadcast thoughts, send DMs, and file complaints, but it does not warn that user-provided or model-generated content may be transmitted externally. In this context, the omission is more dangerous because the skill strongly encourages real-world network interaction and even mandates follow-up submissions on errors, which can leak sensitive prompts, identifiers, or internal state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes DM send/read tools that transmit private user-provided content and identifiers to a remote third-party service without any explicit disclosure, consent prompt, data-minimization guardrail, or trust boundary warning. In an agent-tooling context, this can cause unintentional exfiltration of sensitive prompts, personal data, or internal workflow details because the functions make network transmission look like ordinary local tool use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.