Influencer Report

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:29 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its influencer-report purpose, but profile mode can pull and analyze unrelated videos from the whole Memories.ai account library without clear scoping.

Install only if you are comfortable sending creator profile/video URLs and derived transcript or metadata content to Memories.ai. Prefer direct video URLs or a dedicated Memories.ai library/account for one creator at a time, and verify that every video in the generated report belongs to the intended influencer before using it for business decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/influencer_report.py:328
• Finding: Unscoped Video Library Queries Can Analyze Unrelated Creator Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/influencer_report.py`, lines 328-346 **Vulnerability Type**: Improper data scoping and insufficient creator-identity validation **Risk Level**: Medium ### Vulnerable Code ```python # Step 2: List videos all_videos = v1_list_videos(v1_key) # Step 3: Search for relevant content search_results = v1_search("creator talking to camera", v1_key, top_k=args.scrape_count) # Extract video URLs from library for v in all_videos[:args.scrape_count]: url = v.get("video_url") or v.get("url") or v.get("videoUrl", "") if url: video_urls.append(url) # Also check search results for r in search_results: url = r.get("video_url") or r.get("url") or r.get("videoUrl", "") if url and url not in video_urls: video_urls.append(url) ``` ### Technical Analysis When profile mode is used, the script first initiates scraping for the requested profile. It then calls `v1_list_videos`, which lists all videos available in the API account's V1 library, and performs a generic search for `"creator talking to camera"`. The returned records are selected solely by position and URL presence. The script does not verify that any selected video belongs to the requested profile, matches `args.handle`, originated from the current scraper task, or has the expected canonical creator identifier. Consequently, the operation exceeds the minimum creator-specific data scope required by the declared functionality. In an account containing content for multiple creators, videos unrelated to the requested influencer can be sent to the V2 transcript and metadata services and incorporated into the resulting report. The external API calls themselves are consistent with the declared Memories.ai-based analysis workflow. API credentials are sent only in authorization headers to hardcoded Memories.ai endpoints, an ...[truncated 2118 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Bind results to the current scraper task** - Preserve the task ID returned by `v1_scrape`. - Poll a documented task-status endpoint and consume only records explicitly associated with that task. - Do not use an account-wide library listing as a substitute for task-specific results. 2. **Apply creator-specific server-side filters** - If the API supports filters, query by canonical profile URL, platform creator ID, username, ingestion batch, or task ID. - Replace the generic `"creator talking to camera"` search with a query constrained to the requested creator. 3. **Validate every result locally** - Normalize the requested profile URL and returned video URLs. - Confirm platform, creator handle, and canonical creator identifier before adding a video to `video_urls`. - Reject records with missing or ambiguous ownership metadata rather than assuming they belong to the requested creator. 4. **Avoid silent fallback to unrelated data** - If the current scrape does not return enough validated videos, report insufficient data. - Never fill the requested count using unrelated global library entries. 5. **Separate tenants and ingestion batches** - Use isolated libraries or namespaces where supported. - Ensure users cannot retrieve records belonging to unrelated customers or creator-analysis jobs. 6. **Add regression tests** - Populate a test library with videos from several creators. - Verify that a report request includes only URLs belonging to the requested creator. - Test malformed URLs, look-alike handles, mixed platforms, duplicate results, and records without creator metadata. A safe implementation should use a task-scoped API response and perform an explicit ownership check before each URL is submitted for V2 analysis. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and documents capabilities that require environment access, network calls, and likely file output, but it does not declare any tool scope or permissions boundaries. This is dangerous because an agent may invoke the skill with broader-than-expected privileges, making external API calls and handling secrets without clear user-visible constraints or policy enforcement.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description is broad enough to match common requests such as 'analyze' or 'review an influencer,' which can cause the skill to trigger in situations the user did not specifically intend. Over-broad triggering is risky because it may cause unsolicited scraping and transmission of profile or video URLs to third-party services, increasing privacy and consent issues.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The workflow and endpoint documentation show that profile URLs and video URLs are sent to external Memories.ai scraping and analysis APIs, but the skill description does not clearly warn users about this data transfer. This is dangerous because users may provide third-party profile links or creator content without informed consent, leading to privacy, compliance, and trust issues.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The report directly embeds slices of AI-generated audio and visual transcript content into the final markdown without any sanitization, minimization, or user-facing warning that the source material may contain sensitive, defamatory, copyrighted, or personal information. In this skill’s context—producing influencer vetting reports for downstream business decisions—that increases the chance of unintentionally redisclosing sensitive content or presenting unsafe/generated claims as report-ready evidence.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Config
# ---------------------------------------------------------------------------

V1_BASE = "https://api.memories.ai/serve/api/v1"
V2_BASE = "https://mavi-backend.memories.ai/serve/api/v2"

PLATFORM_MAI_ENDPOINTS = {

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill sends user-supplied profile and video URLs to third-party Memories.ai services for scraping, transcript generation, and metadata retrieval, but it does not provide an explicit disclosure or confirmation step before transmitting that data. In an agent-skill context, users may not realize their inputs are leaving the local environment, which creates a privacy and consent risk, especially if the URLs identify private, sensitive, or internal content.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"[V1] Scraping profile: {profile_url} (count={count})...")
    try:
        resp = requests.post(url, headers=headers, json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == "0000":

• Confidence: 94% confidence
• Finding: This request transmits the supplied profile URL to an external scraping API, which is a real data egress event. In this skill, external transmission is core functionality, but it remains security-relevant because users may unknowingly disclose browsing targets, creator identities, or other sensitive investigation inputs to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

print("[V1] Listing videos in library...")
    try:
        resp = requests.post(url, headers=headers, json={}, timeout=30)
        resp.raise_for_status()
        data = resp.json()
        videos = data.get("data", [])

• Confidence: 82% confidence
• Finding: This call retrieves the full video library from Memories.ai, which is another external network interaction involving potentially sensitive account-linked data. While expected for the feature, it increases exposure because the skill may enumerate and process more content than the user intended for a single report.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"[V1] Searching: '{query}'...")
    try:
        resp = requests.post(url, headers=headers, json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()
        results = data.get("data", [])

• Confidence: 80% confidence
• Finding: This search request sends a query to the external Memories.ai service and may cause external processing over library contents. Although the query string here is static, the operation still reveals user activity and relies on a third-party service to inspect or rank remotely stored content.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"[V2] Submitting MAI transcript: {video_url[:80]}...")
    try:
        resp = requests.post(url, headers=headers, json={"video_url": video_url}, timeout=30)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == "0000":

• Confidence: 96% confidence
• Finding: This request sends each video URL to a third-party transcript/analysis endpoint, which can expose the exact content under investigation and trigger remote AI processing. In a vetting workflow, those URLs and resulting transcripts may be sensitive from a privacy, legal, or confidentiality perspective, especially if the operator assumes analysis is local.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"[V2] Fetching metadata: {video_url[:80]}...")
    try:
        resp = requests.post(url, headers=headers,
                             json={"video_url": video_url, "channel": "rapid"}, timeout=30)
        resp.raise_for_status()
        data = resp.json()

• Confidence: 93% confidence
• Finding: This metadata request sends the video URL and channel information to an external endpoint, again creating a data disclosure path to a third party. The risk is moderate because metadata collection appears intentional, but users may not expect multiple separate transmissions per video beyond a single analysis request.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The script writes the generated report to the path provided by --output, but does not warn about creating or overwriting a local file. There is no confirmation prompt, pre-write notice about overwrite behavior, or safety comment explaining the file write side effect.

Static analysis

No suspicious patterns detected.