OEE Social Research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:13 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent social-research helper, but it can send topics to multiple external services and store raw research artifacts locally with incomplete disclosure and non-working documented controls.

Review before installing. Avoid using this skill for sensitive, confidential, or proprietary topics unless you are comfortable with queries going to third-party search/social endpoints and with local `.cache`, `.logs`, and `.briefings` files retaining those topics. Do not rely on the documented `--tier` or `--briefing` examples as privacy controls until the implementation actually supports them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · social_research.py (reported line 157)May include surrounding context.

python

"Accept": "application/json",
                "X-Subscription-Token": api_key,
            })
            with urllib.request.urlopen(req, timeout=10) as resp:
                data = json.loads(resp.read())
            results = []
            for r in data.get("web", {}).get("results", []):

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · social_research.py (reported line 185)May include surrounding context.

python

try:
            url = f"{base}/search?q={urllib.parse.quote(query)}&format=json&categories=general"
            req = urllib.request.Request(url, headers={"User-Agent": "MuninnRaven/1.0", "Accept": "application/json"})
            with urllib.request.urlopen(req, timeout=8) as resp:
                data = json.loads(resp.read())
            results = []
            for r in data.get("results", []):

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · social_research.py (reported line 296)May include surrounding context.

python

try:
            url = f"{base}/search?q={urllib.parse.quote(query)}&format=json&categories=general"
            req = urllib.request.Request(url, headers={"User-Agent": "MuninnRaven/1.0", "Accept": "application/json"})
            with urllib.request.urlopen(req, timeout=8) as resp:
                data = json.loads(resp.read())
            results = []
            for r in data.get("results", []):

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · social_research.py (reported line 208)May include surrounding context.

python

"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
    })
    try:
        with urllib.request.urlopen(req, timeout=15) as resp:
            html = resp.read().decode("utf-8", errors="replace")
    except Exception as e:
        log.warning(f"DDG search failed: {e}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description states that the skill may use browser scraping as a last resort and store cached results and briefings, but it does not warn users about those behaviors or their privacy implications. Users may unknowingly cause external browsing and persistent local storage of research topics and retrieved content, which can expose sensitive interests, queries, or collected data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "what are people saying about" is extremely broad and can match ordinary user conversation, causing the skill to activate in situations where the user did not explicitly request this capability. Because the skill can perform web search, browser scraping, and caching, accidental invocation can lead to unintended data collection, browsing, or storage beyond user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase "what's the buzz on" is ambiguous and conversational, making it likely to overlap with normal discussion rather than a deliberate request to run the skill. In this skill's context, ambiguous activation is more dangerous because the tool may escalate from API use to web search and browser scraping, increasing the chance of unintended external actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill logs raw user queries, timestamps, and result counts to local files without any explicit user-facing disclosure or consent. In a research tool, queries may contain sensitive investigative topics, personal names, or proprietary subjects, creating a durable local privacy leak and possible forensic exposure to other local users or later collection processes.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Storing raw natural-language queries in plain-text logs and cache creates a straightforward data retention and disclosure path. Even without an active attacker, sensitive search intent can be exposed via local compromise, backups, shared workstations, or later log collection, which is particularly risky for an intelligence/research skill handling potentially delicate topics.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · social_research.py (reported line 66)May include surrounding context.

python

def _tweet_from_dict(d: dict) -> Tweet:
    """Reconstruct Tweet from dict, ignoring extra keys. 🐾"""
    import inspect
    valid = {f.name for f in __import__('dataclasses').fields(Tweet)}
    return Tweet(**{k: v for k, v in d.items() if k in valid})

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cache stores plaintext queries and corresponding results on disk automatically. Because this skill is designed for social research, cached content may reveal sensitive user interests, targets, or investigations and persist longer than the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code transmits user-supplied search topics to Brave and, on fallback, to public SearXNG or DuckDuckGo endpoints without explicit warning or consent. In this skill context, user topics may be highly sensitive research subjects, so externalizing them to multiple third parties materially increases privacy and operational-security risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code explicitly transmits user queries to the Brave Search API, which is an external service. While that may be functionally intended, it is still a security/privacy-relevant behavior because the skill context involves topic research that may reveal sensitive interests or investigative targets to third parties.

Content

Scanner excerpt · social_research.py (reported line 152)May include surrounding context.

python

api_key = os.environ.get("BRAVE_API_KEY", "")
    if api_key:
        try:
            url = f"https://api.search.brave.com/res/v1/web/search?q={urllib.parse.quote(query)}&count=20"
            req = urllib.request.Request(url, headers={
                "Accept": "application/json",
                "X-Subscription-Token": api_key,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Tier 3 sends user queries to public Nitter instances as a last resort, again without explicit disclosure. Public instances are especially risky because they are third-party community services with variable trust, logging, and retention practices, making sensitive-topic leakage more concerning in this research-oriented tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring says injected results 'bypass Tier 2/3 network calls entirely,' but the function still performs FxTwitter lookup_tweet enrichment for each parsed tweet. This can cause unexpected outbound network activity in environments that rely on this function to remain offline or to avoid transmitting sensitive topics externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The generated briefing is automatically persisted to disk under .briefings without warning. Briefings aggregate searched topics, extracted narratives, and notable posts, so automatic storage can create a sensitive artifact that outlives the interactive session and may be discoverable by other users or backup/indexing systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.