Security audit

meme-digger

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed meme-research tool, but it asks users to store full site login cookies in plaintext and reuses them automatically, so it should be reviewed carefully before installation.

Install only if you are comfortable with a research skill that scrapes public web sources and writes local reports/images. Do not provide Bilibili or Tieba cookies unless you need authenticated access; if you do, treat them like passwords, avoid passing them on the command line, keep config/cookies.json out of synced folders and source control, and rotate or revoke the sessions after use. Open generated HTML reports knowing they may contact Google Fonts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to use environment variables, read/write local files, invoke Python via shell, and access remote network resources, yet it declares no permissions or trust boundaries. This is dangerous because operators and hosting platforms cannot accurately assess or constrain what the skill will do, increasing the chance of unintended filesystem changes, network access, or credential exposure during execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior materially exceeds the stated purpose by introducing credential handling, arbitrary image downloading, broader third-party scraping, and local HTML packaging. That mismatch is risky because users may consent to a meme-research skill without realizing it stores authenticated cookies, fetches untrusted remote content, and writes substantial local artifacts, which changes the security and privacy profile significantly.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The module is designed for meme research, but it loads long-lived Bilibili/Tieba cookies from disk or environment variables and makes them available for authenticated scraping across all importers. That expands the skill from public-content collection into account-backed access, increasing the risk of accidental credential misuse, unauthorized access to private/account-scoped data, and credential exposure if the workspace or logs are compromised.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script advertises the output as a self-contained HTML file with zero external dependencies, but it embeds Google Fonts links in the generated page. Opening the report will therefore trigger network requests to third-party domains, which can leak reader metadata such as IP address, user agent, and access timing, and also breaks offline/self-contained guarantees.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: This is the same underlying issue as SDI-1: the documented security/property claim is false because generated reports still depend on third-party font infrastructure. In a report generator that may process sensitive or controversial browsing artifacts, silent outbound requests create an unexpected privacy and integrity risk for users who believe the file is offline-safe.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The invocation guidance is broad enough to match common user phrasing about memes, which can cause the skill to activate in situations the user may not intend. Because this skill performs multi-step external collection from Bilibili and Tieba, overbroad triggering increases the chance of unnecessary network access, scraping, and report generation from casual conversation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs creation of a workspace, multiple markdown files, downloaded images, and a final HTML artifact in the current working directory without prominent warning or confirmation. This is dangerous because it can overwrite, clutter, or expose local data unexpectedly, especially if the current directory is sensitive, synced, or shared.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The documentation tells operators to copy full authenticated Bilibili and Tieba cookies from browser requests into local configuration, but does not strongly warn that these are bearer credentials equivalent to account access. This is dangerous because copied cookies may be leaked through logs, shell history, source control, backups, or other local processes, enabling account compromise or session hijacking.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script automatically loads the user's Bilibili authenticated cookie and sends it with comment API requests without any user-facing disclosure, consent, or scope limitation. In an agent skill context, this is dangerous because it silently performs authenticated actions on behalf of the user, exposing account-linked browsing state and potentially bypassing the user's expectation that the tool is operating anonymously.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This function writes raw service cookies to config/cookies.json in plaintext without any warning, encryption, or access control. Plaintext persistence makes session tokens easy to recover from the filesystem, backups, or repository leaks, enabling account hijacking or misuse of the user's authenticated session.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code automatically reads BILI_COOKIE and TIEBA_COOKIE from the environment and later attaches them to outbound HTTP requests, with no explicit disclosure or confirmation. In agent or shared execution environments, ambient credentials can be unintentionally consumed, causing silent authenticated requests and potential leakage or misuse of user/session tokens beyond the user's expectation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The generated HTML makes background requests to Google font services without any user-facing disclosure. That creates a privacy leak whenever someone opens the report, which is more concerning in this skill because reports may contain browsing-derived meme research, comments, and potentially sensitive cultural or community topics that users expect to review offline.

Ssd 3

Medium

Confidence: 98% confidence
Finding: Instructing users to extract full authenticated site cookies from browser traffic and feed them into automation creates a direct secret-handling risk. In this skill's context the danger is elevated because the cookies are then reused for scraping and validation workflows, making accidental disclosure, credential persistence, and misuse more likely than in a purely manual process.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.