OEE Social Research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:13 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent social-research helper, but it can send topics to multiple external services and store raw research artifacts locally with incomplete disclosure and non-working documented controls.

Review before installing. Avoid using this skill for sensitive, confidential, or proprietary topics unless you are comfortable with queries going to third-party search/social endpoints and with local `.cache`, `.logs`, and `.briefings` files retaining those topics. Do not rely on the documented `--tier` or `--briefing` examples as privacy controls until the implementation actually supports them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

"Accept": "application/json",
                "X-Subscription-Token": api_key,
            })
            with urllib.request.urlopen(req, timeout=10) as resp:
                data = json.loads(resp.read())
            results = []
            for r in data.get("web", {}).get("results", []):

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
            url = f"{base}/search?q={urllib.parse.quote(query)}&format=json&categories=general"
            req = urllib.request.Request(url, headers={"User-Agent": "MuninnRaven/1.0", "Accept": "application/json"})
            with urllib.request.urlopen(req, timeout=8) as resp:
                data = json.loads(resp.read())
            results = []
            for r in data.get("results", []):

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
            url = f"{base}/search?q={urllib.parse.quote(query)}&format=json&categories=general"
            req = urllib.request.Request(url, headers={"User-Agent": "MuninnRaven/1.0", "Accept": "application/json"})
            with urllib.request.urlopen(req, timeout=8) as resp:
                data = json.loads(resp.read())
            results = []
            for r in data.get("results", []):

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 153, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
    })
    try:
        with urllib.request.urlopen(req, timeout=15) as resp:
            html = resp.read().decode("utf-8", errors="replace")
    except Exception as e:
        log.warning(f"DDG search failed: {e}")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The description states that the skill may use browser scraping as a last resort and store cached results and briefings, but it does not warn users about those behaviors or their privacy implications. Users may unknowingly cause external browsing and persistent local storage of research topics and retrieved content, which can expose sensitive interests, queries, or collected data.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase "what are people saying about" is extremely broad and can match ordinary user conversation, causing the skill to activate in situations where the user did not explicitly request this capability. Because the skill can perform web search, browser scraping, and caching, accidental invocation can lead to unintended data collection, browsing, or storage beyond user expectations.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The phrase "what's the buzz on" is ambiguous and conversational, making it likely to overlap with normal discussion rather than a deliberate request to run the skill. In this skill's context, ambiguous activation is more dangerous because the tool may escalate from API use to web search and browser scraping, increasing the chance of unintended external actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill logs raw user queries, timestamps, and result counts to local files without any explicit user-facing disclosure or consent. In a research tool, queries may contain sensitive investigative topics, personal names, or proprietary subjects, creating a durable local privacy leak and possible forensic exposure to other local users or later collection processes.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Storing raw natural-language queries in plain-text logs and cache creates a straightforward data retention and disclosure path. Even without an active attacker, sensitive search intent can be exposed via local compromise, backups, shared workstations, or later log collection, which is particularly risky for an intelligence/research skill handling potentially delicate topics.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

def _tweet_from_dict(d: dict) -> Tweet:
    """Reconstruct Tweet from dict, ignoring extra keys. 🐾"""
    import inspect
    valid = {f.name for f in __import__('dataclasses').fields(Tweet)}
    return Tweet(**{k: v for k, v in d.items() if k in valid})

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cache stores plaintext queries and corresponding results on disk automatically. Because this skill is designed for social research, cached content may reveal sensitive user interests, targets, or investigations and persist longer than the user expects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code transmits user-supplied search topics to Brave and, on fallback, to public SearXNG or DuckDuckGo endpoints without explicit warning or consent. In this skill context, user topics may be highly sensitive research subjects, so externalizing them to multiple third parties materially increases privacy and operational-security risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

api_key = os.environ.get("BRAVE_API_KEY", "")
    if api_key:
        try:
            url = f"https://api.search.brave.com/res/v1/web/search?q={urllib.parse.quote(query)}&count=20"
            req = urllib.request.Request(url, headers={
                "Accept": "application/json",
                "X-Subscription-Token": api_key,

• Confidence: 92% confidence
• Finding: This code explicitly transmits user queries to the Brave Search API, which is an external service. While that may be functionally intended, it is still a security/privacy-relevant behavior because the skill context involves topic research that may reveal sensitive interests or investigative targets to third parties.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Tier 3 sends user queries to public Nitter instances as a last resort, again without explicit disclosure. Public instances are especially risky because they are third-party community services with variable trust, logging, and retention practices, making sensitive-topic leakage more concerning in this research-oriented tool.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring says injected results 'bypass Tier 2/3 network calls entirely,' but the function still performs FxTwitter lookup_tweet enrichment for each parsed tweet. This can cause unexpected outbound network activity in environments that rely on this function to remain offline or to avoid transmitting sensitive topics externally.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The generated briefing is automatically persisted to disk under .briefings without warning. Briefings aggregate searched topics, extracted narratives, and notable posts, so automatic storage can create a sensitive artifact that outlives the interactive session and may be discoverable by other users or backup/indexing systems.

Static analysis

No suspicious patterns detected.