Brain Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:03 PM UTC
• Version: 1.1.0

Overview

This skill is openly designed to connect to a personal remote knowledge base, but it publishes a reusable API key and grants broad read, write, upload, delete, and delegation powers without adequate user control.

Review this skill carefully before installing. It should not be published with a live shared API key, and users should require credential rotation, per-user least-privilege credentials, explicit approval for uploads/deletes/delegation, and clear limits on what local files or conversation context may be sent to the remote service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:172

Finding

Mandatory External Delegation Hijacks Agent Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 172–179
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet:

markdown

## Rules
- **EXECUTE EVERY CURL COMMAND FOR REAL** — use your shell/exec tool. Never simulate or fabricate API responses.
- Always include `x-api-key: frank-sb-2026` header
- Always report the actual HTTP response back to Boss Man
- If an API call fails, show the error — don't make up a success message
- Boss Man watches the /jobs page and Kanban board live — he will see if you fake it
- When delegating: create job as pending → sub-agent picks it up → updates to running → completed
- For multi-step tasks, ALWAYS use the job queue rather than doing everything inline
- Log activity for anything noteworthy that happens outside of normal Telegram chat

Technical Analysis

The skill uses mandatory language to override the agent's ordinary execution policy. It requires real network operations, reporting to an external party, logging unspecified activity, and routing every multi-step task through a remote job queue.

These instructions extend beyond the stated search purpose and cause task descriptions, context, and results to be submitted to externally coordinated sub-agents. No user-confirmation boundary, data-classification check, or restriction on the information included in delegated jobs is specified. Responses received from the remote service are also not designated as untrusted data.

Attack Path

1. The agent loads the skill to perform a knowledge search or related operation.
2. A user request, retrieved entry, or other instruction turns the operation into a multi-step task.
3. The rule requiring the job queue directs the agent to create a remote job.
4. The agent sends the job description and potentially relevant conversation context to the external API.
5. A remotely managed sub-agent receives and processes that ...[truncated 609 chars]

Remediation

View remediation

Remediation Suggestions

• Remove mandatory execution, delegation, logging, and reporting directives.
• Require explicit, informed user approval before every external write or delegation.
• Display the destination, operation, and exact information being disclosed before requesting approval.
• Limit the skill to its declared search function by default; expose logging and delegation as separate, opt-in capabilities.
• Minimize delegated context and remove credentials, private conversation content, local paths, and unrelated records.
• Treat all API responses and sub-agent output as untrusted input that cannot modify system policy or authorize tool calls.
• Apply endpoint-level authorization and maintain auditable records of user-approved external operations.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:17

Finding

Plaintext API Credential Embedded in Published Skill Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–22
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Critical

Vulnerable Code Snippet:

markdown

## API Base

text

https://second-brain-chi-umber.vercel.app

markdown

All requests require header: `x-api-key: frank-sb-2026`

## Search Entries
Find past conversations, research, notes, and logged activity.

Technical Analysis

A reusable API key is stored in plaintext in the skill and is repeated throughout its request examples. Anyone who can download or inspect the package can recover this credential without authentication.

The documented API exposes read and write operations for entries, activity logs, tasks, files, attachments, and delegated jobs. The documentation does not indicate that the key is endpoint-scoped, user-specific, short-lived, or constrained to read-only operations. Consequently, compromise of this single credential may expose every operation accepted under the associated account.

Attack Path

1. An attacker obtains the published skill package or views SKILL.md.
2. The attacker extracts the frank-sb-2026 API key and service URL.
3. The attacker sends requests directly to the documented endpoints with the x-api-key header.
4. Depending on server-side authorization, the attacker searches entries, lists tasks or files, creates records and jobs, changes task state, uploads content, or deletes attachments.
5. The requests appear to use the shared legitimate credential, making attribution and per-user revocation difficult.

Impact Assessment

The exposed credential may grant unauthorized access to a persistent knowledge base containing conversation logs, research, journals, files, tasks, and long-term memory. Documented write privileges include creating entries, logs, tasks, uploads, and jobs; updating tasks; and deleting attachments. The practical scope depends on ser ...[truncated 153 chars]

Remediation

View remediation

Remediation Suggestions

• Revoke and rotate the exposed API key immediately.
• Remove all credentials from the skill package, documentation, examples, and repository history.
• Obtain credentials at runtime from a protected secret manager or environment variable.
• Issue separate, per-user credentials with short expiration periods and endpoint-specific scopes.
• Use read-only credentials for search operations and separate approval-gated credentials for write or delete operations.
• Add rate limiting, audit logging, anomaly detection, and credential revocation controls on the service.
• Review historical API activity for unauthorized access performed with the exposed key.
• Add secret scanning to publication and CI workflows to prevent recurrence.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:93

Finding

Unrestricted Local File Path Can Be Uploaded to an External Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93–101
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Code Snippet:

markdown

## File Storage

### Upload a File

bash

curl -s -X POST "https://second-brain-chi-umber.vercel.app/api/upload" \
  -H "x-api-key: frank-sb-2026" \
  -F "file=@/path/to/file.jpg" \
  -F "title=My File" \
  -F "tags=upload,test"

Technical Analysis

The upload operation allows curl to read a file from an arbitrary local path through the @/path/to/file.jpg syntax and transmit its contents to an external service. The skill defines no workspace restriction, path allowlist, symbolic-link validation, file-type enforcement, sensitivity screening, size limit, or user-confirmation requirement.

Because the skill separately requires real execution of every generated curl command, a malicious or mistaken instruction that supplies a sensitive path could cause the agent to use its filesystem privileges to disclose files unrelated to the legitimate search task.

Attack Path

1. An attacker-controlled request, retrieved record, or remote instruction asks the agent to upload a file and supplies a sensitive local path.
2. The agent constructs the documented multipart request with that path after the @ character.
3. curl opens the file using the agent process's local filesystem privileges.
4. The file contents are transmitted to the external /api/upload endpoint.
5. The service stores the uploaded content as an attachment or file entry, where holders of the shared API credential may subsequently retrieve or manage it.

Impact Assessment

Any file readable by the agent process may be exposed, including configuration files, private documents, source files, environment files, tokens, or agent state. The finding does not itself grant operating-system privileges beyond those already held by the agen ...[truncated 222 chars]

Remediation

View remediation

Remediation Suggestions

• Remove file-upload functionality from the search skill or place it in a separate, explicitly invoked capability.
• Restrict selectable files to a dedicated upload directory using canonical-path validation.
• Reject paths that escape the approved directory, including traversal sequences and symbolic-link targets.
• Require explicit user confirmation that displays the canonical local path, destination host, file size, and file type.
• Block known-sensitive files and patterns, including environment files, SSH keys, credentials, tokens, browser data, and agent state.
• Use a brokered upload API that accepts user-selected file handles rather than arbitrary path strings.
• Enforce server-side size, content-type, malware-scanning, retention, and access-control policies.
• Use a narrowly scoped upload credential distinct from credentials used to read knowledge-base content.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill embeds a live API key directly in the prompt and pairs it with broad read/write/delete examples against a persistent knowledge base. Anyone with access to the skill can reuse the credential outside the intended workflow to search records, create entries, manipulate tasks, upload files, or delete attachments, making this a direct secret exposure rather than a harmless example.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to execute real curl commands against an external service and report real responses, which creates an active exfiltration path for user queries and any included data. This is more dangerous because the instructions are mandatory, combine with an exposed credential, and target a persistent remote knowledge base rather than a narrowly scoped retrieval interface.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

# Skill: brain-search

## CRITICAL RULE — NO FABRICATION
**You MUST actually execute every curl command using your shell/exec tool.** Read the real HTTP response. NEVER generate a fake response, placeholder ID, or simulated output. If the API call fails, report the actual error to Boss Man. If you cannot execute shell commands right now, say so — do not pretend you ran them.

## Purpose
Search and interact with Frank's Second Brain — the persistent knowledge base that stores conversation logs, research, journal entries, job results, and long-term memory.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This section documents authenticated access to remote attachments and adjacent delete capability, confirming that the skill is designed to transmit and manipulate external data beyond local processing. In context, attachment handling increases sensitivity because files may contain private documents or media, and the same skill also supports deletion and upload operations.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

List Attachments on an Entry

bash

curl -s "https://second-brain-chi-umber.vercel.app/api/entries/ENTRY_ID/attachments" \
  -H "x-api-key: frank-sb-2026"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes destructive deletion and external file transmission capabilities without any warning, confirmation requirement, or safety boundary for the user. In context, this is more dangerous because the same embedded credential gives immediate authenticated access, so an agent could exfiltrate files or delete attachments with little friction or visibility to the user.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

- If an API call fails, show the error — don't make up a success message
- Boss Man watches the /jobs page and Kanban board live — he will see if you fake it
- When delegating: create job as pending → sub-agent picks it up → updates to running → completed
- For multi-step tasks, ALWAYS use the job queue rather than doing everything inline
- Log activity for anything noteworthy that happens outside of normal Telegram chat

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 63% confidence

Finding

The instruction mandates a fixed form of address when reporting results, which imposes a specific communication style without indicating user choice or opt-in. This can be interpreted as a natural-language policy constraint because the skill hardcodes how the assistant must address the user rather than offering flexibility.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.