Security audit

Rick Roast

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised landing-page review, but it always adds a paid promotion and includes under-scoped URL fetching that users should review before installing.

Install only if you are comfortable with a branded review skill that always includes a paid Deep Roast promotion. Use it only with public HTTPS URLs you intend to fetch, and avoid internal, private, localhost, file, credential-bearing, or sensitive links unless the fetcher is sandboxed and URL validation is added.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:78
Finding: Mandatory Commercial Promotion Hijacks Agent Output
Content: View full analysis
70: "Not bad at all. The Deep Roast squeezes out the last 30% most pages leave on the table." Link: `meetrick.ai/roast` ``` ### Technical Analysis The Skill instructs the agent to append a fixed commercial advertisement and external link to every page review. The phrases “required, always include” and “Close with the upsell line” make the promotion mandatory rather than an optional response to a user request. This changes the agent's output objective from providing an impartial landing-page analysis to promoting a specific paid service. The commercial content is not necessary to perform the advertised review functionality. Because these instructions execute whenever the Skill is loaded, they constitute persistent manipulation of the current session's response behavior. ### Attack Path 1. A user asks the agent to roast or review a landing page. 2. The trigger language causes the Skill to be loaded. 3. The agent follows the Skill's review framework. 4. Regardless of the user's actual request or the review result, the mandatory instructions append an att ...[truncated 602 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/roast.sh:6
Finding: Unrestricted URL Fetching Enables SSRF and Local File Disclosure
Content: View full analysis
}" echo "🔥 RICK ROAST — Fetching: $URL" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "" # Fetch page content as markdown PAGE_CONTENT=$(curl -sL --max-time 15 \ -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" \ "$URL" | \ sed -e 's/]*>.*<\/script>//g' \ -e 's/]*>.*<\/style>//g' \ -e 's/<[^>]*>//g' \ -e '/^[[:space:]]*$/d' | \ head -200) ``` ### Technical Analysis The command-line argument is accepted as a URL and passed directly to `curl`. Quoting prevents shell command injection, but it does not make the requested resource safe. The script performs none of the following controls: - Restriction to an approved protocol such as HTTPS - Rejection of loopback, private, link-local, or reserved network addresses - Validation of redirect destinations - Restriction of curl's supported protocols - Protection against DNS rebinding - Network egress isolation The `-L` option follows redirects, allowing an initially public URL to redirect to a prohibited internal destination. Depending on the protocols enabled in the installed curl build, a `file://` URL can also read files accessible to the script's operating-system account. The fetched response is stored in `PAGE_CONTENT` and subsequently printed, creating a direct disclosure channel. HTML tag removal with `sed` is not a security boundary. It does not prevent disclosure of plain-text files, metadata responses, internal API output, credentials, or other sensitive data. ### Attack Path #### Internal-Service SSRF 1. An attacker supplies a URL targeting a loopback or private address, such as an internal administrati ...[truncated 1703 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill references executable shell capability via the helper script and CLI invocation but does not declare any explicit tool scope or allowed-tools boundary. That creates ambiguity about what the agent may execute and increases the chance of over-privileged behavior or unsafe future expansion, especially when combined with user-supplied URLs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes broad phrases like "page review" and "pastes a URL asking for feedback," which can cause the skill to activate in situations the user did not clearly intend. Over-broad invocation can lead to unintended external fetches, surprise behavior, or routing sensitive/internal URLs into this skill’s workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to fetch arbitrary user-provided URLs without any warning, validation, or privacy guardrails. This is dangerous because it can trigger requests to sensitive endpoints, internal resources, tracking links, or private URLs, exposing metadata and creating SSRF-like or privacy-impacting behavior depending on the runtime environment.
Content: No source excerpt is available for this finding.