YouMind

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:25 PM UTC
• Version: 3.0.2

Overview

This skill is a straightforward YouMind CLI helper, but users should be careful with the global npm install and avoid putting real API keys directly in commands.

Install only if you trust the @youmind-ai/cli package source, avoid running the npm install with elevated privileges, and use YOUMIND_API_KEY or a protected secret mechanism instead of passing a real key with --api-key. Review destructive YouMind API calls before allowing an agent to run them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 15-23 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ```markdown ## Installation ```bash npm install -g @youmind-ai/cli ``` To verify installation: `youmind` (should print usage info). If the command is not found, install it first before proceeding. ``` ### Technical Analysis The skill directs the agent to install the latest available version of `@youmind-ai/cli` without an exact version pin, lockfile, integrity hash, or other provenance verification. The `-g` option installs the package globally in the user's environment and exposes package-provided executables through the system command lookup path. npm installations may execute package lifecycle scripts with the privileges of the invoking user. Consequently, a compromised publisher account, malicious future release, or other supply-chain compromise could cause arbitrary package code to run during installation. The package identity is consistent with the service described by the skill, but its ownership and contents cannot be verified from the audited project. ### Attack Path 1. An attacker compromises the npm publisher account or otherwise causes a malicious release of `@youmind-ai/cli` to become the version selected by npm. 2. The agent follows the skill and executes `npm install -g @youmind-ai/cli`. 3. npm retrieves the unpinned malicious release. 4. Attacker-controlled lifecycle scripts or package installation code execute with the privileges of the agent's operating-system account. 5. The installed global `youmind` executable can continue executing attacker-controlled behavior when subsequent skill commands are invoked. ### Impact Assessment Successful exploitation could grant the malicious package the same local privileges as the user running npm. This may permit access to user-readable files and environment variables, modification of user ...[truncated 243 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a reviewed exact version, for example `@youmind-ai/cli@3.0.2`, rather than resolving the latest release. - Verify the selected package version and its publisher against an authoritative YouMind distribution channel. - Record and validate the expected package integrity hash. - Prefer a project-local installation governed by a committed lockfile instead of a global installation. - Run installation in a sandbox or restricted environment with minimal filesystem and credential access. - Disable npm lifecycle scripts where compatible with the package, or audit all lifecycle scripts before allowing them to execute. - Document a trusted package registry and reject unexpected registry overrides. - Avoid running the installation with `sudo`, an administrator account, or other elevated privileges.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:37
• Finding: API Key May Be Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 37 **Vulnerability Type**: Sensitive credential passed as a command-line argument **Risk Level**: Low ```markdown Or pass per-command with `--api-key sk-ym-xxx`. ``` ### Technical Analysis The documentation recommends a command-line option through which a YouMind API key can be supplied directly. If a user substitutes a real credential for the example value, the secret may be retained in shell history, terminal session records, automation logs, process telemetry, or command auditing systems. On some operating systems, command-line arguments can also be observed by other local processes or users while the command is running. The file does not contain a real hardcoded credential. The risk arises when a user follows the documented pattern with an actual API key. ### Attack Path 1. A user invokes the CLI with a real credential using the documented `--api-key` option. 2. The shell records the complete command in history, a logging system captures it, or a local observer inspects the process arguments. 3. An attacker with access to that history, log, telemetry source, or process information retrieves the API key. 4. The attacker supplies the recovered key to the YouMind API. 5. The attacker performs any API operation authorized for that credential until it is revoked or expires. ### Impact Assessment Exploitation could expose the affected user's YouMind API privileges. Depending on the permissions associated with the key and the available API endpoints, an attacker may be able to inspect, create, modify, or delete boards, crafts, notes, picks, materials, and related account content. This issue does not directly grant operating-system privileges; its scope is limited to the permissions assigned to the compromised API credential.
• Remediation: ## Remediation Suggestions - Recommend `YOUMIND_API_KEY` or a protected credential store as the primary authentication mechanism. - Remove command-line credential passing from the recommended workflow, or clearly warn that arguments may be recorded or observed. - Never place real API keys in reusable shell scripts, command histories, documentation examples, or CI command strings. - Configure automation systems to inject the credential through protected secret variables and redact it from logs. - If command-line use is unavoidable, disable history for that command where supported and ensure process telemetry does not retain arguments. - Use narrowly scoped, short-lived API credentials where the service supports them. - Rotate and revoke any key suspected of appearing in command history, logs, or process captures.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs users to pass the API key via `--api-key sk-ym-xxx`, which can expose the secret through shell history, process listings, terminal logging, and audit tooling. In this skill's context, the risk is heightened because it is an API-management CLI intended for regular authenticated use, making repeated secret exposure more likely.

Static analysis

No suspicious patterns detected.