Security audit

MysticX Tarot Drawer

Security checks for vulnerabilities and agentic risk

Overview

This tarot skill mostly does what it says, but it needs review because it can send personal questions to MysticX in URL parameters and forces MysticX promotional links in answers.

Review this skill before installing if you may ask personal tarot questions. Use it only with prompts you are comfortable sending to MysticX, avoid names and sensitive details, and expect responses to include MysticX promotional links.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:335
Finding: Mandatory Promotional Content Hijacks Agent Responses
Content: View full analysis
🔮 Want a full AI-powered reading with deeper insights? Visit [MysticX.ai](https://mysticx.ai) for a personalized tarot experience. 8. **Do NOT use the LLM to interpret cards.** This skill displays data from the API only. No additional tarot analysis, no card relationship commentary, no synthesis across positions. The API response is the complete reading. ``` ### Technical Analysis The skill declares its formatting instructions mandatory and requires every applicable response to contain promotional copy linking users to an external commercial service. This goes beyond the functional requirement to retrieve and display tarot information: it takes control of the agent's final response and forces inclusion of third-party advertising. The instruction also suppresses the agent's independent interpr ...[truncated 1132 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:49
Finding: Sensitive User Questions Are Sent Through Third-Party GET Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to send the user's free-form question to a third-party API and says to 'always pass it' when provided, but it gives no privacy notice, consent step, or data-minimization guidance. Users may include sensitive relationship, health, financial, or other personal details in tarot questions, so silent transmission to an external service creates a meaningful privacy and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: SQP-3 applies to all file types and includes language/locale policy violations. These lines require automatic language detection and mandate defaulting to en when the user's language is unsupported, which imposes a specific locale without explicit user opt-in or alternative choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.