Security audit

Grazer Skill Main

Security checks for vulnerabilities and agentic risk

Overview

Grazer is not clearly malicious, but it can post or comment on public services and includes autonomous/telemetry-adjacent features with incomplete guardrails.

Install only if you need Grazer's engagement features, not just read-only discovery. Use read-only mode unless you intentionally configure API keys, prefer dry-run where available, avoid the TypeScript CLI for unattended posting without your own approval wrapper, do not enable autonomous posting integrations without rate limits and logs, and review the telemetry/SEO and external LLM endpoint behavior before using sensitive data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: This status document exposes operational deployment targets, internal host locations, and notes about token availability that are not necessary for a public-facing skill status file. While it does not disclose the actual secret value, it increases attack surface by revealing infrastructure details and the existence/location of credentials, which can aid reconnaissance and follow-on compromise.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The `seo_ping` and `seo_agent_profile` methods add backlink/SEO heartbeat behavior that is unrelated to a content-discovery client and enable transmission of externally controlled metadata to a third-party relay. In an agent-skill context, this expands the trust boundary, creates a covert promotion/telemetry channel, and can be abused to exfiltrate identifying data or manipulate external web content under the guise of normal discovery operations.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: `report_download` performs an external POST to `https://bottube.ai/api/downloads/skill` but the docstring only says 'Report download to BoTTube tracking system' and omits that it silently transmits telemetry off-host. In a skill/library used by agents, undisclosed network reporting undermines operator consent and can leak usage, platform, version, and timestamp metadata to a third party.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: _validate_svg() is described as validating and sanitizing SVG, but it only checks that the content starts with <svg, injects xmlns if missing, and enforces a size limit. For LLM-generated SVG, this means dangerous active content such as <script>, event handlers, external references, foreignObject, or javascript/data URIs can pass through unchanged and later execute or trigger content injection depending on the SVG rendering context.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The CLI branding and top-level description say it only 'grazes' or discovers content, but the implementation also includes commands that post, comment, and reply on external platforms. This mismatch can mislead users, reviewers, or automation into granting trust or permissions they would not give to a tool capable of performing remote write actions.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The package description presents the module as a content-discovery library, but the implementation also performs account-authenticated posting, commenting, replying, image generation via external services, and telemetry. This capability mismatch is security-relevant because consumers may grant trust or permissions based on the narrower stated purpose and unknowingly enable outbound data transfer or write actions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The reportDownload method transmits package usage telemetry to a remote service, including platform, version, skill name, and timestamp, without evidence of explicit user consent or clear necessity for the advertised discovery purpose. Even if limited, unsolicited telemetry creates privacy and trust risks and can disclose environment or adoption metadata to a third party.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The comments/documentation state that callers receive a structured error envelope, but the tests assert that raw exceptions are propagated instead. This contract mismatch can cause consuming agents or applications to mishandle failures, skip expected retry/error logic, or crash unexpectedly, which becomes more dangerous in automation pipelines that rely on predictable error semantics.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The deployment guide includes commands that publish packages to public registries and send metadata to external services, but it does not clearly warn the operator that these are external, potentially irreversible actions. In an agent-skill context, this is risky because an automated system or inattentive user could execute them and unintentionally disclose code, metadata, or ownership-linked repository information.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The quick publish workflow wraps build, test, package publication, tagging, and GitHub push into a single script without emphasizing that these actions may be externally visible and hard to undo. In a skill distribution setting, this increases the chance of accidental public release or unauthorized publication if the script is run by an agent or user without careful review.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This section explicitly promotes autonomous 24/7 operation, auto-response, and learning behavior without any warning about account actions, moderation risk, privacy implications, or the possibility of unwanted posting. In the context of an agent skill, this can cause unsupervised user-account activity and unintended interactions at scale, especially if operators enable it without guardrails.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The integration example instructs users to automatically check notifications, generate responses, post comments, discover content, and create posts with no caution about consent, content review, or operational limits. Because this is turnkey automation code for social platforms, it materially increases the risk of spam, reputational harm, policy violations, and unintended disclosure through automated responses.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly states that NPM and PyPI installs are reported to remote BoTTube endpoints, which is telemetry-like behavior tied to installation events. Because this outbound reporting is documented as part of the skill but not presented with a clear opt-in/opt-out, data disclosure warning, or privacy details at install time, users and agent operators may unknowingly transmit metadata such as install events, IP-derived information, or environment-associated signals to a third party.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises autonomous discovery, notifications, auto-responses, training, and an autonomous loop without clearly warning that these features can perform external write actions or repeated engagement on third-party platforms. In an agent-skill context, this can mislead operators into granting the skill broader autonomy than intended, increasing the risk of unwanted posting, spam, reputation damage, or policy violations across multiple services.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The CLI examples include posting content to 4claw and writing an SVG file to disk, but they do not include any user-facing caution that these commands have persistent external or local side effects. While documentation examples are not executable by themselves, omission of safety notes in an agent-facing skill increases the chance of accidental posting or unintended file creation when the examples are copied into automation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file includes direct publish and upload commands for NPM, PyPI, and a remote API registration flow, but gives no warning that these actions cause public release or external network side effects. In an agent-skill context, operational instructions like these are risky because an automated system or inattentive user could execute them and unintentionally publish artifacts or transmit data to third-party services.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document lists remote deployment steps, live host addresses, and system modification targets without any caution that these instructions affect production or quasi-production systems. In a skill package, this creates unsafe operational affordances: an agent or user may treat the instructions as ordinary setup text and perform changes on live infrastructure, potentially causing unauthorized modification or service disruption.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The download-reporting call is wrapped in a broad `try/except` with silent failure, which is characteristic of stealth telemetry because users receive no notice whether data is being sent. In an agent ecosystem, this makes the behavior harder to audit and increases the risk of unapproved outbound communication from otherwise trusted automation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The plugin uses a plain HTTP endpoint for outbound requests to the arXiv API, so queries and responses can be intercepted or modified by an on-path attacker. This could expose user search terms and allow tampering with returned paper metadata, causing integrity and privacy issues.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The agent automatically generates and sends replies to external notifications based only on a configuration flag, with no approval gate, rate limiting, recipient validation, or safety review. In an agent context, this can cause unintended engagement, spam, reputational damage, or unsafe disclosure if malicious or manipulative inputs trigger inappropriate responses.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The code logs notification sender identities and message content directly to stdout, which may expose private or sensitive data in terminal history, log aggregation systems, or shared environments. While not an exploit by itself, it creates an avoidable data leakage path.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: Training data derived from user interactions is persisted to a predictable file in the home directory without any retention controls, permission hardening, or disclosure. This increases the risk of local privacy exposure if the host is shared, backed up broadly, or later compromised.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The 'comment' and 'post' commands execute irreversible remote actions immediately using provided API credentials, without a confirmation prompt, dry-run mode, or summary of the target action. In an agent skill context, this is more dangerous because automated or indirect invocation can cause unintended posting, spam, reputational harm, or abuse across multiple platforms.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code sends the full user prompt to an externally configured LLM endpoint via axios.post, which can expose potentially sensitive user content to a third party without any disclosure, consent, minimization, or destination allowlisting in this component. In a skill context, prompts may contain private, regulated, or proprietary text, so silent outbound transmission creates a real privacy and data-governance risk even if it is intended functionality.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This file exposes numerous methods that perform authenticated external write actions such as posting, replying, commenting, and answering across multiple platforms. In an agent skill context, silent write capabilities are dangerous because an upstream prompt, plugin, or compromised workflow could cause unauthorized public actions, spam, reputation damage, or leakage of sensitive content using stored API credentials.

Static analysis

Detected: suspicious.exposed_resource_identifier, suspicious.install_untrusted_source

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

Code: suspicious.exposed_resource_identifier
Location: config.example.json:18

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

Code: suspicious.exposed_resource_identifier
Location: grazer/imagegen.py:233

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.example.json:18