Security audit

atypica-user-interview

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI user-research integration, but it handles sensitive research data and API credentials with some under-scoped sharing and endpoint controls that users should review before installing.

Install only if you are comfortable sending research prompts, interview outputs, persona queries, and generated reports to atypica.ai. Avoid confidential or regulated data unless you understand the service's retention and sharing model, do not use public share links for sensitive reports, do not enable verbose mode with private inputs, and do not run the bash wrapper in an environment where ATYPICA_ENDPOINT may be set by untrusted configuration.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mcp-call.sh:38
Finding: Unrestricted Endpoint Override Can Exfiltrate Bearer Credentials and Research Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api-reference.md (reported line 27)May include surrounding context.
md
**Authentication**: `Authorization: Bearer <api_key>` Get API key from atypica.ai account settings (format: `atypica_xxx`) ## Tool Schemas

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell-based execution via curl/jq and scripts/mcp-call.sh, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an unnecessary capability gap where an assistant may invoke shell access more broadly than intended, increasing the risk of command execution or data exfiltration if the skill is triggered in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest includes broad triggers like 'talk to users', 'get user feedback', and 'ask real people', which are common phrases that can match many benign requests. Over-broad activation increases the chance this skill is invoked unexpectedly, causing user data or prompts to be sent to a third-party service without deliberate user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly highlights shareUrl as a public shareable link and encourages direct sharing, but it provides no privacy warning or guidance about sensitive content in generated reports. If users include proprietary, personal, or confidential research inputs, the public report link could expose that data to anyone with the URL.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest frames this skill as a user-research tool for simulated interviews and focus groups, but the documented toolset is a generic 'Universal Agent' API with general chat session creation, message persistence, historical chat listing, and retrieval of arbitrary universal/study chat content. Those broader operations are not clearly limited to interview simulation and materially expand the described scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest focuses on simulating personas to gather qualitative human insights, but the API reference also exposes standalone retrieval of generated reports and podcasts, including shareable URLs and media metadata. Artifact distribution and podcast generation are not an obvious implementation detail of conducting simulated user interviews.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The reference provides shareable report and podcast URLs but does not warn that these links may grant access to research artifacts outside the immediate authenticated session. In a skill handling potentially sensitive interview outputs, users may unintentionally disclose confidential research data by sharing or logging these URLs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The API exposes full persona prompts, which may contain proprietary prompt engineering, sensitive synthetic profile details, or hidden behavioral instructions not necessary for ordinary interview use. In the context of a user-research skill, direct retrieval of underlying prompts broadens data exposure and can leak internal model scaffolding or reusable prompt assets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: In verbose mode the script logs the full JSON-RPC request payload, which includes user-supplied arguments and may contain sensitive research prompts, identifiers, or conversation data. Because this is a user-research skill handling potentially sensitive qualitative data, printing payload contents to stderr increases the chance of exposure through terminal history, CI logs, or centralized log collection.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/mcp-call.sh (reported line 210)May include surrounding context.
sh
# Make API call local response response=$(curl -s -X POST "$ENDPOINT" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $TOKEN" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script supports writing API responses directly to any caller-supplied file path, and those responses can contain sensitive interview transcripts, reports, persona outputs, or tokens/identifiers. In the context of simulated user interviews and focus groups, storing such output without warning or safeguards can lead to unintended retention, disclosure via shared directories, or later exfiltration by other processes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: Listing all historical universal chat sessions is an account-level management capability rather than a direct requirement for running a user interview or focus group. It exposes broader session enumeration functionality that is not clearly necessary for the manifest's narrow research-assistant purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Returning full persona prompts without warning can expose sensitive or proprietary prompt content to downstream consumers who may assume it is safe to display, store, or redistribute. In this skill context, persona internals are more sensitive than ordinary output because they may encode hidden instructions or licensed content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.