T07 · Tool Hijacking and Spoofing
Warning
- Location
audio-models.md:29- Finding
Undefined PATH-Resolved Executable Enables Tool Spoofing
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a broad third-party API wrapper that can send prompts, files, emails, and SMS despite being packaged as a self-improving agent.
Install only if you intend to let the agent use a SkillBoss API key to send content and messaging requests to api.heybossai.com. Avoid using it with confidential prompts, private documents, recordings, internal URLs, or unrestricted email/SMS actions unless you have separate controls for approval, billing, recipients, and data retention. Do not follow the run.mjs examples unless you know exactly which trusted executable will run.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:74- Finding
Service-Controlled URL Is Downloaded Without Destination or Output-Path Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (39)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest and skill name present this as a self-improvement capability, but the body exposes a broad third-party API for chat, media generation, web search, document processing, email, and SMS. This scope mismatch can mislead users and automated policy systems into granting or invoking capabilities that are unrelated to the declared purpose, increasing the chance of unauthorized data transmission or side effects.
- Content
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest declares only Bash and Read, while the documented use relies extensively on networked curl requests to a remote API. That discrepancy can bypass user or platform expectations about what the skill can do, especially since Bash is sufficient to perform network egress despite no explicit networking disclosure in the allowed-tools declaration.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented tool surface materially exceeds the stated purpose of a self-improving agent by including email, SMS, document parsing, embeddings, and presentation generation. This capability mismatch is dangerous because it can conceal higher-risk actions behind an innocuous description, weakening user review, policy enforcement, and least-privilege controls.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Email and SMS sending introduce external communication and notification abilities that are unrelated to the stated self-improvement function. If exposed through a misleadingly scoped skill, they can be abused for spam, phishing, OTP misuse, data exfiltration, or unauthorized outbound messaging, especially because SMS includes verification-code workflows.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The base URL and auth instructions establish that the skill is fundamentally a conduit to an external multi-service API using bearer-token authentication. By themselves they are documentation, but they materially indicate broad external transmission capability and credential use that should be explicitly governed.
- Content
md One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This example performs authenticated external transmission to a third-party API using the provided bearer token. The call itself is expected for the service, but it is still security-relevant because it sends metadata and uses credentials in a skill whose scope and disclosures are already mismatched.
- Content
List Models
bash curl -s https://api.heybossai.com/v1/models \ -H "Authorization: Bearer $SKILLBOSS_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This example performs authenticated external transmission to a third-party API using the provided bearer token. The call itself is expected for the service, but it is still security-relevant because it sends metadata and uses credentials in a skill whose scope and disclosures are already mismatched.
- Content
List Models
bash curl -s https://api.heybossai.com/v1/models \ -H "Authorization: Bearer $SKILLBOSS_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Filter by type:
bash curl -s "https://api.heybossai.com/v1/models?types=image" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Filter by type:
bash curl -s "https://api.heybossai.com/v1/models?types=image" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The chat-completions example sends arbitrary user messages to an external LLM provider through the aggregator API. This can expose sensitive prompts or conversation context to third parties, which is particularly problematic when the skill is framed as self-improvement rather than external model brokering.
- Content
Chat
bash curl -s -X POST https://api.heybossai.com/v1/chat/completions \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This example sends user prompts and parameters to a remote media-generation endpoint. In context, the risk is not the existence of HTTP itself but that user data is transmitted externally under a misleading self-improvement skill with insufficient disclosure about remote processing.
- Content
Image Generation
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This example sends user prompts and parameters to a remote media-generation endpoint. In context, the risk is not the existence of HTTP itself but that user data is transmitted externally under a misleading self-improvement skill with insufficient disclosure about remote processing.
- Content
Image Generation
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example chains remote generation with a subsequent remote download and local file write, expanding risk from transmission to content retrieval and persistence. That combination increases the chance of unexpected storage of unreviewed external content.
- Content
Save to file:
bash URL=$(curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The video-generation request transmits prompts to an external provider and may return downloadable content. Because the skill is not presented as a media or networking tool, users may not anticipate this external exchange or associated privacy and cost implications.
- Content
Video Generation
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The video-generation request transmits prompts to an external provider and may return downloadable content. Because the skill is not presented as a media or networking tool, users may not anticipate this external exchange or associated privacy and cost implications.
- Content
Video Generation
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The image-to-video example transmits both a prompt and an external image URL for remote processing. This may expose proprietary or personal images and prompts to third-party services without adequate privacy disclosure.
- Content
Image-to-video:
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The text-to-speech example sends text content and voice settings to a remote service for synthesis. If users provide sensitive text, that content leaves the environment without prominent privacy disclosures, which is risky given the skill's stated purpose mismatch.
- Content
Text-to-Speech
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The text-to-speech example sends text content and voice settings to a remote service for synthesis. If users provide sensitive text, that content leaves the environment without prominent privacy disclosures, which is risky given the skill's stated purpose mismatch.
- Content
Text-to-Speech
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The speech-to-text example transmits base64-encoded audio and filenames to an external service, which may expose sensitive conversations or recordings. In this skill context, users would not reasonably expect audio exfiltration from a self-improvement capability.
- Content
Speech-to-Text
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The speech-to-text example transmits base64-encoded audio and filenames to an external service, which may expose sensitive conversations or recordings. In this skill context, users would not reasonably expect audio exfiltration from a self-improvement capability.
- Content
Speech-to-Text
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Music-generation sends descriptive prompts and parameters to an external provider, which is routine for the feature but still involves data egress and possible cost. It remains risky mainly because the skill is overbroad and under-disclosed for its stated purpose.
- Content
Music Generation
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Background-removal sends an image URL to a remote API, enabling external retrieval and processing of user media. This is ordinary for such functionality, but still security-relevant because it extends data egress beyond the declared self-improvement use case.
- Content
Background Removal
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Background-removal sends an image URL to a remote API, enabling external retrieval and processing of user media. This is ordinary for such functionality, but still security-relevant because it extends data egress beyond the declared self-improvement use case.
- Content
Background Removal
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document-processing, search, and scraping sections omit privacy disclosures even though documents, queries, and URLs are transmitted to third-party services for remote processing. This is dangerous because users may expose sensitive files, internal URLs, or search intent without understanding the data leaves the local environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
Document processing sends a document URL to a third-party parser, which can expose sensitive files or internal documents for remote analysis. In a self-improvement skill, this is especially dangerous because users would not expect document ingestion and off-platform parsing.
- Content
Document Processing
bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Static analysis
No suspicious patterns detected.