Security audit

Act

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly coherent, but it can publish public activity listings in bulk using a chat-provided API key and web-sourced content without a clear review gate.

Install only if you trust fore-vip with activity publishing authority. Use a limited API key if possible, review all batch-created activities before allowing publication, and avoid sharing credentials in normal chat when a safer secret entry method is available.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The batch workflow directs the agent to use external web_search to discover third-party events and image URLs, then republish them via create_activity. That expands the skill beyond its declared MCP scope into scraping and republishing unverified third-party content, which can lead to data provenance, copyright, impersonation, and spam/abuse risks. Because the skill is designed to automate publication, the unsafe discovery step directly feeds privileged write actions.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill claims API keys are not stored and must be re-requested for each creation round, but the batch mode reuses one provided key across multiple create_activity calls. This inconsistency weakens the stated secret-handling model and normalizes longer-lived in-session credential reuse, increasing the chance of over-broad use or accidental retention in agent context/logs.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The manifest states that the service will automatically download a user-supplied cover URL and re-upload it to cloud storage, but it does not clearly warn users about this remote fetch behavior. That creates SSRF-style risk and privacy/surprise risk: a crafted URL could trigger server-side network access, and ordinary users may not realize third-party resources will be fetched and persisted.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to ask the user for an API key in natural language during routine operation. This creates a credential-harvesting pattern inside the conversation channel, where secrets are more likely to be exposed in transcripts, memory, logs, or to downstream components; in skill context, this is especially dangerous because the collected secret immediately authorizes a write operation to an external service.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The batch workflow repeats the conversational API-key request pattern and combines it with multi-step automation and repeated privileged writes. This increases exposure time and blast radius: a single chat-supplied credential can be used across several externally visible actions, making accidental leakage or misuse more damaging in this skill context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.