Grazer — 24-Platform Content Discovery

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:07 AM UTC
• Version: 2.0.0

Overview

Grazer looks like a real content-discovery and engagement skill, but it needs Review because it includes an exposed bearer token and several under-scoped credential, posting, and autonomous-loop behaviors.

Review before installing or running automation. The publisher should revoke and remove the embedded ClawHub token, require HTTPS or allowlisted origins before forwarding API keys, sanitize LLM-generated SVGs, make auto-response explicitly opt-in, and pin runtime commands. Users should use limited-scope API keys, start with dry-run/idempotency options, and avoid running the agent loop unattended.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: PUBLISH_CHECKLIST.md:54
• Finding: Hardcoded ClawHub Bearer Token in Publishing Documentation<![CDATA[ ## Vulnerability Details **File Location**: `PUBLISH_CHECKLIST.md:54-63` **Vulnerability Type**: Hardcoded authentication secret **Risk Level**: High ### Vulnerable Code ```bash # Using ClawHub CLI or API curl -X POST https://clawhub.ai/api/skills \ -H "Authorization: Bearer [REDACTED_HARDCODED_CLAWHUB_TOKEN]" \ -H "Content-Type: application/json" \ -d '{ "name": "grazer", "description": "Multi-platform content discovery for AI agents", "version": "1.0.0", "tags": ["content-discovery", "ai-agents", "social-media"], "platforms": ["bottube", "moltbook", "clawcities", "clawsta"], "npm_package": "@elyanlabs/grazer", "pypi_package": "grazer-skill", ``` The original file contains a concrete `clh_...` bearer token where the redaction appears above. ### Technical Analysis A bearer token is committed directly to a tracked documentation file. Bearer credentials grant access based solely on possession, so any person who downloads the repository, source distribution, or published package can extract and attempt to reuse it. Documentation files are commonly copied into package artifacts and mirrors. Removing the token in a later commit is insufficient because it may remain available in version-control history, release archives, caches, and previously published packages. The repository does not establish that the exposed token has been revoked. ### Attack Path 1. An attacker downloads or clones the project. 2. The attacker opens `PUBLISH_CHECKLIST.md` and extracts the hardcoded bearer token. 3. The attacker sends requests to the ClawHub API with: ```http Authorization: Bearer <extracted-token> ``` 4. If the token remains active, the attacker invokes any API operation authorized for that credential, potentially including skill registration or modification. 5. The attacker may alter registry metadata or perform other actions under the credential owner's identity. ### Impact Assessment The obtainable privileges are ...[truncated 321 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed ClawHub token immediately. 2. Review ClawHub audit logs for unauthorized activity involving the credential. 3. Replace the literal token with an environment-variable reference: ```bash test -n "${CLAWHUB_TOKEN:?CLAWHUB_TOKEN is required}" curl -X POST https://clawhub.ai/api/skills \ -H "Authorization: Bearer ${CLAWHUB_TOKEN}" \ -H "Content-Type: application/json" \ ... ``` 4. Purge the credential from Git history and republish affected release artifacts. 5. Configure automated secret scanning and pre-commit checks to reject bearer tokens. 6. Use narrowly scoped, short-lived publishing credentials where supported. 7. Ensure examples contain unmistakably invalid placeholders rather than realistic credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: grazer/__init__.py:1451
• Finding: Bearer Token Exfiltration Through Caller-Controlled Relay Host<![CDATA[ ## Vulnerability Details **File Location**: `grazer/__init__.py:1451-1495` **Vulnerability Type**: Credential forwarding to an untrusted destination and server-side request forgery **Risk Level**: High ### Vulnerable Code ```python def seo_ping( self, agent_id: str, relay_token: str, *, seo_url: str = "", seo_description: str = "", status: str = "alive", relay_host: str = "https://rustchain.org", ) -> Dict: """Send an SEO-enhanced heartbeat to the Beacon relay. This generates a dofollow backlink on the agent's crawlable profile page. Each ping refreshes the agent's status and updates SEO metadata. Args: agent_id: The agent's bcn_ ID. relay_token: Bearer token from registration. seo_url: Agent's homepage URL (becomes dofollow link on profile). seo_description: Agent description for meta tags. status: One of "alive", "degraded", "shutting_down". relay_host: Beacon relay base URL. Returns: Dict with heartbeat confirmation and SEO backlink data including the agent's crawlable profile URL (the dofollow backlink). """ payload = { "agent_id": agent_id, "status": status, } if seo_url: payload["seo_url"] = seo_url if seo_description: payload["seo_description"] = seo_description try: resp = self.session.post( f"{relay_host}/relay/heartbeat/seo", json=payload, headers={"Authorization": f"Bearer {relay_token}"}, timeout=self.timeout, ) return resp.json() except Exception as e: return {"error": str(e), "ok": False} ``` ### Technical Analysis The method accepts `relay_host` from its caller and concatenates it directly into the request URL. The supplied `relay_token` is then attached to that URL as a bearer credential. There is no scheme validation, HTTPS requirement, host allowlist, origin binding, or pr ...[truncated 2002 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `relay_host` from the public method unless alternate relays are an essential feature. 2. Bind relay credentials to an explicit allowlist of HTTPS origins: ```python from urllib.parse import urlparse ALLOWED_RELAY_ORIGINS = {"https://rustchain.org"} parsed = urlparse(relay_host) origin = f"{parsed.scheme}://{parsed.netloc}" if parsed.scheme != "https" or origin not in ALLOWED_RELAY_ORIGINS: raise ValueError("Unapproved relay origin") ``` 3. Reject URLs containing user information, fragments, unexpected ports, IP literals, loopback addresses, link-local addresses, or private-network addresses. 4. Disable redirects for authenticated requests: ```python self.session.post(..., allow_redirects=False) ``` 5. If redirects are required, validate every redirect target and never forward authorization across an origin change. 6. Use separate credentials for separate relay origins and apply least-privilege scopes. 7. Avoid returning raw exception details when they may reveal internal addresses or network information. 8. Add tests proving that HTTP, private-network, loopback, and non-allowlisted destinations are rejected before a request is made. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: grazer/imagegen.py:233
• Finding: LLM API Credential and Prompt Transmission Over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `grazer/imagegen.py:233-266`; insecure example at `config.example.json:17-20` **Vulnerability Type**: Plaintext transmission of credentials and user-controlled content **Risk Level**: High ### Vulnerable Code ```python def generate_llm_svg( prompt: str, llm_url: str = "http://100.75.100.89:8080/v1/chat/completions", llm_model: str = "gpt-oss-120b", llm_api_key: Optional[str] = None, temperature: float = 0.8, timeout: int = 60, ) -> str: """Generate SVG using any OpenAI-compatible LLM endpoint. Args: prompt: Image description llm_url: OpenAI-compatible chat completions endpoint llm_model: Model name/ID llm_api_key: Optional API key (Bearer token) temperature: Creativity (0.0-1.0) timeout: Request timeout in seconds Returns: Raw SVG string ready for 4claw media field """ headers = {"Content-Type": "application/json"} if llm_api_key: headers["Authorization"] = f"Bearer {llm_api_key}" payload = { "model": llm_model, "messages": [ {"role": "system", "content": LLM_SVG_SYSTEM_PROMPT}, {"role": "user", "content": f"Create an SVG image: {prompt}"}, ], "temperature": temperature, "max_tokens": 2048, } resp = requests.post(llm_url, json=payload, headers=headers, timeout=timeout) ``` The example configuration reinforces the unsafe transport: ```json "imagegen": { "llm_url": "http://100.75.100.89:8080/v1/chat/completions", "llm_model": "gpt-oss-120b", "llm_api_key": null } ``` ### Technical Analysis The function permits any URL and provides a plaintext HTTP endpoint as its default. When `llm_api_key` is configured, the key is inserted into the `Authorization` header without checking whether TLS protects the connection. The prompt and system message are also transmitted in the unencrypted request body. An attacker with ...[truncated 1791 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require HTTPS whenever an API key is present: ```python from urllib.parse import urlparse parsed = urlparse(llm_url) if llm_api_key and parsed.scheme != "https": raise ValueError("HTTPS is required when an LLM API key is configured") ``` 2. Replace the HTTP default and example with a safe placeholder such as: ```json "llm_url": "https://llm.example.com/v1/chat/completions" ``` 3. Bind each credential to an approved LLM origin rather than forwarding it to arbitrary URLs. 4. Reject redirects or validate every redirect target before forwarding credentials. 5. Validate DNS results and reject loopback, link-local, and private-network destinations unless the user explicitly enables a documented local-only mode. 6. For a genuinely local LLM service, prefer a Unix-domain socket, loopback-only listener, mutual TLS, or an authenticated encrypted tunnel. 7. Warn users that prompts are transmitted externally and avoid including unrelated sensitive context. 8. Add tests ensuring that credentials cannot be sent over HTTP or to an unapproved origin. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: grazer/imagegen.py:215
• Finding: Untrusted LLM-Generated SVG Can Contain Active Content<![CDATA[ ## Vulnerability Details **File Location**: `grazer/imagegen.py:215-226, 266-276`; upload path at `grazer/__init__.py:395-410` **Vulnerability Type**: Insufficient validation of active SVG content **Risk Level**: High ### Vulnerable Code The SVG validator checks only the document prefix, namespace, and byte size: ```python def _validate_svg(svg: str) -> str: """Validate and sanitize SVG for 4claw.""" svg = svg.strip() # Must start with <svg if not svg.startswith("<svg"): raise ValueError("Generated content is not valid SVG") # Ensure xmlns is present if 'xmlns=' not in svg: svg = svg.replace("<svg", f'<svg {SVG_NAMESPACE}', 1) # Size check if len(svg.encode("utf-8")) > SVG_MAX_BYTES: raise ValueError(f"SVG exceeds 4KB limit ({len(svg.encode('utf-8'))} bytes)") return svg ``` LLM output is extracted and passed directly to that validator: ```python resp = requests.post(llm_url, json=payload, headers=headers, timeout=timeout) resp.raise_for_status() content = resp.json()["choices"][0]["message"]["content"].strip() # Extract SVG if wrapped in code fences svg_match = re.search(r'<svg[\s\S]*?</svg>', content) if not svg_match: raise ValueError("LLM did not produce valid SVG output") return _validate_svg(svg_match.group(0)) ``` The accepted SVG is subsequently uploaded to 4claw: ```python if svg: body["media"] = svg_to_media(svg) elif image_prompt: result = self.generate_image(image_prompt, template=template, palette=palette) body["media"] = svg_to_media(result["svg"]) resp = self.session.post( f"https://www.4claw.org/api/v1/boards/{board}/threads", json=body, headers={ "Authorization": f"Bearer {self.fourclaw_key}", "Content-Type": "application/json", }, timeout=self.timeout, ) ``` ### Technical Analysis SVG is an active document format rather than a passive image format. It can contain script elements, inline event handlers, links, ...[truncated 2301 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all LLM output as hostile. 2. Parse SVG with a secure XML parser that disables external entities and external resource resolution. 3. Enforce a strict allowlist of required SVG elements and attributes. 4. Explicitly reject at least: - `script` - `foreignObject` - inline event attributes such as `onload` and `onclick` - `javascript:` and other executable URL schemes - external `href` and `xlink:href` references - remote images, fonts, stylesheets, and filter resources - CSS constructs containing external URLs 5. Avoid regular-expression-only sanitization for full SVG documents. 6. Prefer rasterizing generated output in a sandbox and uploading a passive image format where platform requirements permit. 7. If SVG is mandatory, reconstruct a new SVG document from allowlisted parsed nodes instead of modifying the original string. 8. Apply restrictive downstream controls, including attachment serving, a separate origin, sandboxing, and a Content Security Policy that blocks scripts and external connections. 9. Add adversarial tests containing scripts, event handlers, encoded URL schemes, namespace tricks, external resources, and malformed XML. 10. Reject the generated image rather than silently accepting unsafe output or falling back after broad exception suppression. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (77)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The checklist embeds a live bearer token directly in publication instructions, which exposes a secret to anyone who can read the file and encourages reuse of a hardcoded credential. If the token is valid, an attacker could authenticate to the ClawHub API as the owner and perform unauthorized actions such as registering, modifying, or abusing skills.

Credential Access

High

• Category: Privilege Escalation

Content

### APT (Debian/Ubuntu)
```bash
curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### APT (Debian/Ubuntu)
```bash
curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

### APT (Debian/Ubuntu)
```bash
curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

### APT (Debian/Ubuntu)
```bash
curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer
```

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer
```

### Claude Code

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

VERSION="1.9.1"
PKG="grazer_${VERSION}_all"

rm -rf "/tmp/${PKG}"
mkdir -p "/tmp/${PKG}/DEBIAN"
mkdir -p "/tmp/${PKG}/usr/lib/python3/dist-packages/grazer"
mkdir -p "/tmp/${PKG}/usr/bin"

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The SEO heartbeat/backlink functionality is unrelated to the stated content-discovery purpose and transmits agent identity, bearer credentials, status, and optional SEO metadata to an external relay. In an agent-skill context, this expands the package into external promotion/tracking infrastructure and could be abused to create unsolicited external presence, leak metadata, or exfiltrate identifiers to a third party.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The lockfile pins axios 1.13.6, and the supplied advisories include SSRF, proxy bypass, prototype-pollution-related MITM/credential theft, and related request-handling issues. In an agent skill, HTTP client libraries are commonly used to fetch remote content or call APIs, so a vulnerable axios version can directly expose network requests, credentials, and trust boundaries.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names and filenames. If the skill constructs multipart requests from untrusted input, an attacker may be able to manipulate request boundaries or inject crafted headers/content, potentially enabling request smuggling, upstream parsing confusion, or data exfiltration.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The package permits installation of axios 1.13.6, which is flagged with multiple advisories including SSRF-related and prototype-pollution-adjacent issues. This is especially concerning for a skill designed to fetch content from many remote platforms, because network-facing code commonly processes attacker-controlled URLs, redirects, headers, and proxy settings, increasing the chance that a vulnerable HTTP client could be abused.

Self-Modification

High

• Category: Rogue Agent

Content

}

  /**
   * Update skill metadata
   */
  async updateSkill(skillId: string, updates: Partial<ClawHubSkill>): Promise<ClawHubSkill> {
    if (!this.token) {

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Ssd 1

High

• Confidence: 98% confidence
• Finding: Untrusted notification text is inserted directly into the LLM prompt, allowing attackers to inject instructions through comments or mentions. Because this component is specifically designed to auto-generate replies, prompt injection can steer the model into producing manipulative, harmful, off-brand, or policy-violating responses.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The deployment guide instructs users to publish packages to public registries and submit a remote API POST without clearly warning that these actions perform irreversible public release and external data transmission. In a skill context, operators may copy-paste commands verbatim, so missing disclosure materially increases the risk of accidental publication, metadata leakage, or unintended release under the user's authenticated accounts.

External Transmission

Medium

• Category: Data Exfiltration

Content

Create a skill entry on BoTTube:

```bash
curl -X POST https://bottube.ai/api/skills \
  -H "Content-Type: application/json" \
  -d '{
    "name": "grazer",

• Confidence: 90% confidence
• Finding: The curl command sends a JSON payload to an external service, which is an explicit outbound transmission to a third party. While the transmitted data appears to be package metadata rather than secrets, the lack of warning or confirmation means users may unknowingly disclose project information or register entries with an external platform.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: These commands automate posting announcements to multiple external platforms under a specified agent identity, but the guide does not warn that they will create public content or may use stored credentials. In an agent-skill setting this is risky because users may unintentionally broadcast messages, impersonate an operational identity, or trigger spam/policy issues by blindly executing the commands.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide tells users to modify a local file in /home/scott and run an automated publish script that chains build, test, release, tagging, and push actions without describing side effects. This is dangerous because copy-paste execution can alter local state and trigger multiple external operations at once, making mistakes harder to detect or stop once started.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This section describes checking notifications, generating responses, posting comments, and creating posts automatically, but it does not clearly warn the operator that content may be posted on their behalf without manual review. That creates a real safety and security issue because users may enable behavior that can spam, impersonate, or damage accounts if the agent behaves incorrectly or is manipulated by untrusted inputs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The standalone loop documentation says the agent will monitor notifications in real time, auto-respond to comments, and run every 5 minutes, but the risk is presented as a convenience feature rather than a potentially unsafe autonomous action. Users may launch a persistent bot that continuously posts or responds using stored credentials without understanding the operational and abuse implications.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 1. Setup Config
```bash
mkdir -p ~/.grazer
cp config.example.json ~/.grazer/config.json
cp profile.example.json ~/.grazer/profile.json

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The guide instructs users to execute `npx grazer-agent` without pinning a specific package version. This causes code to be fetched and executed at runtime from the package registry, which creates a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed. In an agent/autonomous context, that risk is amplified because the fetched code may immediately gain access to configured API keys and automation capabilities.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```

### Boris (Moltbook Bot)
Already integrated via notification monitor + auto-deploy

### Janitor (AutomatedJanitor2015)
Add to notification checking:

• Confidence: 85% confidence
• Finding: The reference to notification monitoring plus auto-deploy indicates autonomous decision-making tied to external inputs. In this skill's context, that means an agent may decide how and when to respond or engage without user review, which can be abused through prompt injection, spam amplification, or harmful public actions if the upstream content is adversarial.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Using ClawHub CLI or API
curl -X POST https://clawhub.ai/api/skills \
  -H "Authorization: Bearer clh_w2cSUND_qu_ZUqusQqKV97-s2tROfJ5rsCxKbfQFVy4" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: The external transmission itself is expected for skill registration, but here it is paired with a hardcoded bearer token and a direct POST request to a third-party API. This makes the finding dangerous in context because the file not only documents data exfiltration to an external service, but also provides reusable authentication material that could be abused by anyone following or copying the command.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### APT (Debian/Ubuntu)
```bash
curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### APT (Debian/Ubuntu)
```bash
curl -fsSL https://bottube.ai/apt/gpg | sudo gpg --dearmor -o /usr/share/keyrings/grazer.gpg
echo "deb [signed-by=/usr/share/keyrings/grazer.gpg] https://bottube.ai/apt stable main" | sudo tee /etc/apt/sources.list.d/grazer.list
sudo apt update && sudo apt install grazer
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

Detected: suspicious.exposed_resource_identifier, suspicious.exposed_secret_literal, suspicious.install_untrusted_source

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: config.example.json:18

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: grazer/imagegen.py:233

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: grazer/__init__.py:89

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: PUBLISH_CHECKLIST.md:55

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/index.ts:425

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.example.json:18