Security audit

1

Security checks for vulnerabilities and agentic risk

Overview

Grazer is a real content discovery and engagement tool, but it includes public posting and automation paths with enough ambiguity and weak safeguards to require review before use.

Install only if you intend to let this tool use your social/platform credentials. Keep it in read-only discovery mode unless you deliberately run post/comment commands, change auto_respond to false before using the agent loop, avoid HTTP LLM endpoints, and test with dry-run/idempotency keys before allowing public posts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (40)

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The package is presented as a multi-platform content discovery client, but it also includes unrelated Beacon/SEO heartbeat functionality that transmits agent identity, status, SEO URL, and description to an external relay. That expands the trust boundary and creates a covert/extraneous outbound communication channel that consumers may not expect from a discovery library, increasing privacy, supply-chain, and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The client contains a download-reporting telemetry function that posts package name, platform, version, and timestamp to an external tracking endpoint unrelated to core discovery behavior. Even though it is not automatically invoked in this file, embedding silent telemetry in a library creates a risk of undisclosed data exfiltration if called by installer hooks or downstream code.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI is described as a content discovery tool, but it also exposes state-changing capabilities including posting comments, creating posts, and writing files via image generation. This mismatch can mislead users, wrappers, or agent frameworks into invoking the tool under a read-only assumption, causing unintended publication or local file modification.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The `comment` command promises to reply or comment, but in the `clawsta` branch it calls `client.post_clawsta(args.message)`, which creates a new public post instead of commenting on a target. In agent or automation contexts, this semantic mismatch can cause unintended public content creation, data leakage, or spam when a caller believes it is performing a scoped reply.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The script uses `npm test || true`, which suppresses test failures and allows publishing to continue even when the test suite reports errors. In a release pipeline, this defeats a key quality and security gate and can result in shipping broken or vulnerable packages to NPM and PyPI.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The CLI presents itself as a content discovery tool, but it also exposes write-capable actions such as posting, replying, and commenting across multiple platforms. This mismatch can mislead users, reviewers, or automation into granting credentials or approving execution under the assumption of read-only behavior, increasing the risk of unintended external side effects and account misuse.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code sends the user prompt to a caller-supplied `llmUrl` via `axios.post`, which can disclose potentially sensitive prompt content to any external endpoint configured by the operator. This is not overtly malicious, but it is a real data-exposure risk because there is no allowlist, trust validation, or consent/disclosure mechanism in this file.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The module description does not mention that it reports download telemetry to a remote service. Undisclosed telemetry is risky because it creates unexpected outbound data flows and may violate user expectations, privacy requirements, or enterprise software review assumptions.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The file presents the package as content discovery while also exposing image generation that can forward prompts and API credentials to an external LLM service via configurable endpoints. Hidden external processing increases data exposure risk because callers may unknowingly send sensitive prompts or metadata off-platform.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The module description does not mention that it reports download telemetry to a remote service. Undisclosed telemetry is risky because it creates unexpected outbound data flows and may violate user expectations, privacy requirements, or enterprise software review assumptions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This section contains commands that publish packages publicly to NPM and PyPI and send a POST request to an external service, but the document does not clearly warn that these actions are outbound and can cause irreversible public release. In a deployment guide for an agent skill, that omission is risky because a user or automated agent may execute the commands without understanding they disclose project metadata and publish artifacts to third-party services.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: These commands automate posting announcements to multiple third-party social platforms, yet the guide does not prominently disclose that running them will publicly publish content under a specified agent identity. That is dangerous in an agent-skill context because automated execution could create unintended public posts, leak operational details, or damage reputation across several platforms at once.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly promotes unattended discovery, monitoring, auto-response, and continuous posting behavior every 5 minutes without any visible warning, approval gate, rate limiting guidance, or account-risk notice. In an agent-integration context, this can lead operators to deploy bots that take account-impacting actions autonomously, increasing the chance of spam, policy violations, reputational harm, or unintended interactions at scale.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The sample configuration sets "auto_respond": true and describes a fully autonomous loop, but provides no adjacent safety warning or operational safeguards. This normalizes enabling account-impacting automation by default, which can cause unintended outbound messages, abuse amplification, and account sanctions if integrated as documented.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README discloses that NPM and PyPI installs are reported to BoTTube, but this notice appears late in the document after installation commands. Users may install the package before understanding that installation triggers outbound telemetry, which undermines informed consent and can leak metadata such as package usage, source IP, and timing to a third party.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises autonomous discovery, notifications, auto-responses, training from interactions, and a continuous engagement loop, but the documentation does not clearly foreground that these features can perform external writes or sustained interactions on third-party platforms. In an agent-skill context, this can lead operators to enable the skill without understanding that it may post, reply, or interact continuously across multiple services, increasing the risk of unintended actions, spam, policy violations, or data leakage.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The configuration documents use of a remote LLM endpoint for image generation but does not warn that prompts, generated content, or related data may be transmitted to an external server. This creates privacy and confidentiality risk because users may assume local-only processing while the skill can send content to a third-party endpoint under their control or another operator's control.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This status document includes concrete publication and API registration commands for NPM, PyPI, and ClawHub, but presents them as routine next steps without any caution that they cause external, irreversible actions. In an agent-skill context, normalizing these commands increases the chance an automated system or inattentive operator will publish packages or register services using configured credentials, potentially exposing code, consuming secrets, or causing unintended supply-chain impact.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document references specific VPS and local deployment targets and instructs installation/integration actions on remote systems without warning that these steps modify live environments. In a skill consumed by agents, this can facilitate unauthorized or accidental changes to production-like hosts, especially because explicit host locations make the targets immediately actionable.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The download reporting code sends installation metadata to a remote service without any in-code disclosure, consent mechanism, or user-facing warning. Undisclosed telemetry in a client library is dangerous because users and downstream integrators may unknowingly leak environment and usage signals to a third party, violating privacy and enterprise policy expectations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The plugin uses an unencrypted HTTP endpoint for all arXiv API requests, so search queries and responses can be observed or modified by a network attacker via man-in-the-middle interception. In this skill context, queries may reveal user research interests or sensitive internal topics, and tampered responses could mislead downstream consumers with spoofed paper metadata.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The function sends the user-provided prompt to a remote LLM endpoint, and the default URL uses plain HTTP rather than HTTPS. That creates a real confidentiality risk because prompts may contain sensitive user or agent data and can be intercepted in transit or disclosed to an unexpected external service.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: An optional API key is placed into an Authorization header for requests to an arbitrary caller-supplied endpoint. In this file, the default endpoint is also HTTP, so credentials could be exposed over the network or sent to an untrusted service if the URL is misconfigured or attacker-controlled.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The episodes() method fetches an arbitrary feed_url over the network with no validation of scheme, host, or address range. If an attacker can influence feed_url, this can be abused for server-side request forgery behavior, causing the runtime to contact unintended internal or sensitive endpoints; the podcast-discovery context reduces suspicion of intent but does not remove the risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The loop can automatically generate and send replies to comments or replies whenever config.auto_respond is enabled, with no human approval, rate limiting, policy checks, or safety guardrails visible in this file. In this agent context, that creates a real risk of abusive, inappropriate, or attacker-triggered outbound actions based on untrusted notification content.

Static analysis

Detected: suspicious.exposed_resource_identifier, suspicious.install_untrusted_source

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

Code: suspicious.exposed_resource_identifier
Location: config.example.json:18

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

Code: suspicious.exposed_resource_identifier
Location: grazer/imagegen.py:233

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.example.json:18