Security audit

Miniflux

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says for Miniflux, but it stores and reuses an API key in ways that need careful review before installation.

Install only if you are comfortable giving the skill a Miniflux API key that can read and modify your feed state. Prefer MINIFLUX_URL and MINIFLUX_API_KEY environment variables over --api-key, use an HTTPS Miniflux URL you control, avoid running it in shared environments, and check or restrict permissions on ~/.local/share/miniflux/config.json if you ever use CLI flags.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/miniflux-cli.py:27
Finding: Miniflux API key is stored in a plaintext configuration file without enforced restrictive permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/miniflux-cli.py:35
Finding: Unvalidated server URL can transmit the API key over plaintext HTTP or to an unintended host
Content: View full analysis
miniflux.Client: config = load_config() base_url = args.url or os.environ.get("MINIFLUX_URL") or config.get("base_url") api_key = args.api_key or os.environ.get("MINIFLUX_API_KEY") or config.get("api_key") if not base_url: print("Error: Miniflux URL not configured.", file=sys.stderr) print("Set MINIFLUX_URL environment variable or use --url", file=sys.stderr) print(f"Config file: {CONFIG_PATH}", file=sys.stderr) sys.exit(1) if not api_key: print("Error: Miniflux API key not configured.", file=sys.stderr) print("Set MINIFLUX_API_KEY environment variable or use --api-key", file=sys.stderr) print(f"Config file: {CONFIG_PATH}", file=sys.stderr) sys.exit(1) if args.url or args.api_key: save_config(base_url, api_key) return miniflux.Client(base_url, api_key=api_key) ``` ### Technical Analysis The server URL is accepted from a command-line argument, environment variable, or configuration file and passed directly to `miniflux.Client`. There is no validation of: - The URL scheme. - Whether TLS is required. - The destination host. - Embedded URL credentials. - Whether the configured origin unexpectedly changed. Network communication and API-key authentication are necessary for the declared Miniflux functionality. However, allowing an unrestricted destination or plaintext HTTP transport is not necessary. If an `http://` URL is used, the API credential and returned feed data can be exposed to network interception. If an attacker influences `--url`, `MINIFLUX_URL`, or the configuration file, the credential can be sent directly to an attacker-controlled server. ### Attack Path #### Plaintext inte ...[truncated 1268 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/miniflux-cli.py:51
Finding: API key accepted through command-line arguments and silently persisted
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/miniflux-cli.py:3
Finding: Runtime dependency is automatically downloaded using an open-ended version constraint
Content: View full analysis
=3.12" # dependencies = ["miniflux>=1.1.4"] # /// ``` The project documentation states that execution automatically installs dependencies through `uv`, but the project contains no reviewed lockfile or integrity hashes. ### Technical Analysis The constraint `miniflux>=1.1.4` permits any future compatible release selected by the package resolver. Consequently, the code that executes can change after this Skill has been reviewed, without any change to the audited repository. The imported dependency runs in the same Python process as the Skill: ```python import miniflux ``` It therefore has access to the process environment, filesystem privileges, command-line arguments, and Miniflux API key available to the CLI. An upstream package compromise or malicious future release could execute code when imported. This is a supply-chain weakness rather than evidence that the current `miniflux` package is malicious. No typosquatted package or known malicious version was established during the static audit. ### Attack Path 1. A future version satisfying `miniflux>=1.1.4` is compromised or published with malicious code. 2. On a fresh environment or dependency update, `uv run` resolves and downloads that version. 3. The script imports `miniflux`, executing package initialization code. 4. The malicious dependency accesses the API key, environment, filesystem, or network using the Skill process's privileges. 5. Credentials or local data may be transmitted externally, or Miniflux operations may be altered. The same risk applies if the package index or dependency-resolution path is compromised. ### Impact Assessment A compromised dependency executes with all privileges of the user running the Skill. Potential impac ...[truncated 507 chars]
Remediation: View remediation
=`. - Generate and commit a lockfile containing resolved transitive dependencies. - Use cryptographic hashes where supported to verify downloaded artifacts. - Configure an explicit trusted package index instead of relying on ambient resolver configuration. - Perform dependency updates through a reviewed process with security scanning and release-diff inspection. - Consider vendoring a minimal reviewed client or implementing the small required API surface with a standard HTTP library if this reduces supply-chain exposure. - Run the Skill in a constrained environment with limited filesystem and network access so that a compromised dependency cannot access unrelated user data. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly instructs users to pass a URL and API key via CLI flags and states that these values are saved to ~/.local/share/miniflux/config.json, but it does not warn that this results in local persistent storage of sensitive credentials, likely in plaintext. API keys for feed-management access can be abused by other local users, malware, backups, or logging/history mechanisms, leading to unauthorized access to the user's Miniflux instance.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises executable behavior that can read environment variables and persist configuration, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this weakens reviewability and can lead to unintended access to secrets or filesystem writes because consumers cannot tell from the manifest what capabilities the skill requires.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs users to pass API keys via CLI flags and notes that they may be saved to a local config file, but it does not clearly warn about credential exposure risks. CLI arguments may be visible in shell history or process listings, and persisted credentials on disk may be accessible to other local processes or users if not protected.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI stores the Miniflux API key on disk in a JSON config file, expanding the exposure window of a bearer credential beyond the current session. In agent environments, local state may be readable by other tools, users, backups, or logs, so unnecessary persistence materially increases the risk of credential theft.
Content: No source excerpt is available for this finding.

Tainted flow: 'CONFIG_PATH' from os.environ.get (line 21, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 85% confidence
Finding: The config file path is derived from XDG_DATA_HOME, which is taken directly from the environment, and the tool writes credentials to that path without validating that it is safe or intended. In an agent or multi-tenant context, a manipulated environment could redirect the API key to an attacker-controlled location or an unexpected file, causing credential disclosure or overwriting sensitive files accessible to the process.
Content: Scanner excerpt · scripts/miniflux-cli.py (reported line 34)May include surrounding context.
python
def save_config(base_url: str, api_key: str): CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(CONFIG_PATH, "w") as f: json.dump({"base_url": base_url, "api_key": api_key}, f, indent=2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The tool silently persists a sensitive API key to disk when --url or --api-key is supplied, without warning the user that a long-lived secret will be written locally. This is dangerous because users may reasonably expect CLI credentials to be session-only, and silent persistence increases the chance of accidental disclosure through shared filesystems, backups, or later compromise.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest focuses on listing/reading articles, marking them read, and managing feeds/categories, which suggests interaction with existing Miniflux content state. The refresh command initiates server-side feed polling/update activity, a broader operational action not described in the manifest text.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation includes commands that change Miniflux state, such as marking articles read or unread and refreshing feeds, without clearly warning that these operations modify remote data. In an agent workflow this can cause unintended actions or data integrity issues if a user expects read-only browsing behavior from a content-access skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The script performs remote API operations against the configured Miniflux server, potentially transmitting article metadata, feed state changes, and credentials. While this is part of the CLI's purpose, the code lacks any direct user-facing warning at execution time about contacting the remote server or using supplied credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.