Security audit

Vdoob

Security checks for vulnerabilities and agentic risk

Overview

This skill’s core Vdoob integration is disclosed, but it enables recurring automatic external posting by default and includes unrelated hardcoded credential material.

Install only if you intentionally want a Vdoob agent that can register an account, run repeatedly, store credentials and thinking-pattern files locally, and publish answers externally. Before use, disable default auto-answering and the cron job unless you explicitly want unattended posting, remove/rotate the exposed API key, and avoid storing sensitive personal views unless there is a clear way to inspect and delete them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

Location: vdoob_cron.json:3
Finding: Enabled Recurring Job Causes Persistent Autonomous Agent Activity
Content: View full analysis
Vulnerability Details

File Location: vdoob_cron.json, lines 3–26
Vulnerability Type: Persistent scheduled Agent execution
Risk Level: High

Vulnerable Code

json
{ "id": "vdoob-auto-check", "agentId": "main", "name": "Vdoob自动检查问题", "enabled": true, "createdAtMs": 1771463300000, "updatedAtMs": 1771463300000, "schedule": { "kind": "cron", "expr": "*/30 * * * *", "tz": "Asia/Shanghai" }, "sessionTarget": "isolated", "wakeMode": "now", "payload": { "kind": "agentTurn", "message": "检查vdoob问题", "model": "minimax/MiniMax-M2.1", "thinking": "off", "timeoutSeconds": 300 }, "delivery": { "mode": "announce" } }

Technical Analysis

The package defines a scheduled job that is enabled by default and invokes the main Agent every 30 minutes. The job survives individual interactive sessions and initiates an Agent turn without requiring contemporaneous user approval.

The invoked workflow is designed to fetch pending questions from Vdoob and, when automatic answering is enabled, publish generated answers. The project also defaults AUTO_ANSWER to true. Consequently, installing or activating the Skill may establish recurring network access and externally visible publication behavior.

Periodic operation is consistent with the declared question-checking feature, but enabling persistence and automatic publication by default exceeds the minimum privileges required for an on-demand question-answering tool. The same functionality could be provided through explicit user invocation or an opt-in scheduler.

Attack Path

A user installs or activates the Skill.

The bundled cron configuration is registered with enabled set to true.

Every 30 minutes, the scheduler wakes the main Agent in an isolated session.

The Agent receives the instruction to check Vdoob questions.

The workflow contacts V ...[truncated 767 chars]
Remediation: View remediation
Remediation Suggestions

Distribute the scheduled job with "enabled": false.

Require explicit, informed user consent before creating or enabling any recurring job.

Present the schedule, destination service, model cost, submitted data, and automatic-publication behavior before consent.

Separate periodic fetching from answer publication. Scheduled runs should retrieve metadata only, while publishing should require explicit approval.

Default AUTO_ANSWER to false.

Add rate limits, maximum daily executions, quota limits, and a global stop control.

Provide clear commands and documentation for disabling and permanently deleting the job.

Confirm that uninstalling the Skill removes its scheduled task and associated state.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:914
Finding: Live-Looking API Credential Embedded in Distributed Documentation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 914–915
Vulnerability Type: Hardcoded secret
Risk Level: Critical

Vulnerable Code

markdown
- **创建龙虾**: `POST https://vdoob.com/api/game/lobster` Body: `{"agent_id": "a71c2531-5204-4902-a6f0-2ce32467bcfe", "api_key": "vd_88044f136ff96e42095f9e2da6e96023b1cc3912e538796c85ee1e1f9824339a", "model_name": "minimax", "location": "Laizhou"}`

Technical Analysis

The Skill documentation contains a concrete agent identifier and a plaintext, live-looking API key rather than placeholders. Anyone who can read the package can extract the credential without executing the Skill.

The surrounding documentation identifies API operations that accept this key, including game-entity creation, vision retrieval, and movement. If the credential remains valid, possession of the package may therefore be sufficient to impersonate the associated Agent for those operations.

Embedding credentials in source code or documentation prevents effective access control because package distribution, source mirrors, backups, audit logs, and version-control history all become copies of the secret.

Attack Path

An attacker downloads the Skill package or accesses a repository, archive, cache, or log containing SKILL.md.

The attacker extracts the plaintext agent_id and api_key.

The attacker calls the documented Vdoob game endpoints using those values.

If the key is valid and authorized, Vdoob processes the calls as the associated Agent.

The attacker can continue issuing operations until the credential is revoked, rotated, or otherwise expires.

Impact Assessment

The obtainable privileges are limited by the server-side permissions assigned to the exposed API key. Based on the documented endpoints, potential impact includes:

Impersonation of the associated Agent for game API operations.

Unauthorized creation or control of game entities.

...[truncated 381 chars]
Remediation: View remediation
Remediation Suggestions

Immediately revoke and rotate the exposed API key.

Review Vdoob access logs for unauthorized use of the credential.

Remove the credential from the current file and all repository history, release archives, caches, and published packages.

Replace concrete values with unmistakable placeholders such as ${VDOOB_AGENT_ID} and ${VDOOB_API_KEY}.

Store credentials in a dedicated secret manager or protected runtime environment variable.

Ensure locally stored credential files have owner-only permissions.

Use narrowly scoped, short-lived tokens rather than long-lived account credentials.

Add automated secret scanning to pre-commit hooks and release pipelines.

Verify that game credentials cannot access unrelated Agent, messaging, payment, or account-management endpoints.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:901
Finding: Documentation Encourages Transmission of API Keys in URL Query Strings
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 901 and 919
Vulnerability Type: Sensitive credential exposure through URLs
Risk Level: High

Vulnerable Code

markdown
- **视野**: `GET /api/game/lobster/{id}/vision?api_key=...`

markdown
- **视野**: `GET /api/game/lobster/{lobster_id}/vision?api_key=...

Technical Analysis

The documentation prescribes passing an API key as an api_key query parameter. URLs are commonly retained by infrastructure that does not treat them as secret material, including:

Web server and reverse-proxy access logs.

API gateway and load-balancer logs.

Browser history.

Monitoring, tracing, and analytics platforms.

Network debugging tools.

Support captures and error reports.

Referrer headers in some navigation scenarios.

TLS protects a request while it is in transit but does not prevent endpoints, proxies, clients, or observability systems from recording the complete URL. This creates unnecessary credential exposure beyond what is required for the declared functionality.

Attack Path

A user or Agent follows the documentation and sends a request containing the API key in the query string.

A server, proxy, gateway, monitoring system, browser, or debugging tool records the complete URL.

A person or compromised service with access to those records extracts the API key.

The extracted key is replayed against Vdoob endpoints.

Requests are accepted with the privileges assigned to that key until it is revoked or expires.

Impact Assessment

The scope is determined by the permissions of the exposed API key. Potential impact includes unauthorized retrieval of game-state information, control of associated entities, quota consumption, and impersonation of the corresponding Agent. If the credential is shared across other Vdoob APIs, the impact may extend to those APIs as well.

This issue does not itself provide l ...[truncated 151 chars]
Remediation: View remediation
Remediation Suggestions

Remove support and documentation for authentication through query parameters.

Transmit credentials in an authorization header, such as Authorization: Bearer <token>, or a dedicated secret header.

Configure servers and gateways to reject query-string credentials.

Redact sensitive headers and parameters from application, proxy, tracing, and analytics logs.

Rotate any key that has already been used in a URL because it may exist in retained logs.

Use short-lived and narrowly scoped access tokens.

Add automated tests that fail when secret-like values appear in request URLs.

Document secure request examples that use HTTPS and header-based authentication.

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:458
Finding: Generated Answers Are Automatically Modified with Mandatory Skill Branding
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 458–466
Vulnerability Type: Persistent output manipulation through Skill instructions
Risk Level: Low

Vulnerable Code

python
answer = f"""{opener}： {body} --- 回答人：vdoob-lobster""" if len(answer) < 600: answer += f"

Technical Analysis

The answer-generation function unconditionally appends a fixed Vdoob attribution to every generated answer. The modification is unrelated to whether attribution is requested by the owner or necessary to answer the external question.

Because the Skill also supports automatic answer submission, this forced content can be published to an external platform without the owner reviewing it. The behavior changes the Agent's output policy in favor of Skill branding rather than preserving user control over generated content.

This does not override safety controls or grant additional system privileges. It is nevertheless a form of instruction-level output hijacking because loading and using the Skill introduces persistent, mandatory text into otherwise user-directed answers.

Attack Path

The Skill fetches a pending question.

generate_answer constructs an answer body.

The function appends the fixed vdoob-lobster attribution.

With automatic answering enabled, submit_answer publishes the modified response.

The external response contains Skill-selected promotional attribution even when the owner did not request it.

Impact Assessment

The impact is limited to generated and externally submitted content. Potential consequences include:

Unwanted branding or promotion in the owner's responses.

Misrepresentation of authorship.

Violation of platform rules concerning signatures or promotional content.

Reduced owner control over published output.

Reputational damage when automatic submissions contain inappropriate attribution.

No local privilege esca ...[truncated 79 chars]
Remediation: View remediation
Remediation Suggestions

Remove mandatory attribution from the answer-generation function.

Make signatures an explicit, default-off configuration option.

Show the exact answer to the owner before publication when attribution is enabled.

Keep promotional or branding content separate from substantive answers.

Ensure automatic answering never changes authorship attribution without informed consent.

Add tests confirming that generated answers contain only question-relevant content unless the user explicitly enables a signature.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tainted flow: 'url' from os.getenv (line 156, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · vdoob_tool.py (reported line 83)May include surrounding context.
python
try: url = f"{VDOOB_API}/webhook/{AGENT_ID}/pending-questions" params = {"limit": limit} resp = requests.get(url, params=params, timeout=30) if resp.status_code == 200: data = resp.json()

Tainted flow: 'url' from os.getenv (line 156, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · vdoob_tool.py (reported line 128)May include surrounding context.
python
if selected_stance: data["selected_stance"] = selected_stance resp = requests.post(url, json=data, timeout=30) if resp.status_code == 200: result = resp.json()

Tainted flow: 'url' from os.getenv (line 156, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · vdoob_tool.py (reported line 157)May include surrounding context.
python
try: url = f"{VDOOB_API}/agents/{AGENT_ID}/stats" resp = requests.get(url, timeout=30) if resp.status_code == 200: stats = resp.json()

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to learn and persist the owner's 'thinking patterns' from local storage, framing personal reasoning as reusable data. Capturing and reusing such sensitive behavioral profiles increases privacy risk, especially when the agent is designed to answer external users 'like you' for profit.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code automatically treats any sufficiently long message as reusable 'thinking' and stores it locally. This is overbroad data capture that can collect sensitive or irrelevant user content and later reuse it to shape external outputs.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback logic proposes extracting 'thinking' from conversation history and saving it, which amounts to retention and repurposing of user message content beyond the original interaction. This broadens collection scope without clear consent and can capture sensitive opinions or personal information.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly claims stance choices should reflect the owner's judgment, but the implementation randomly selects among valid stances. This creates deceptive autonomous behavior and can submit opinions the owner does not hold, especially on public or monetized platforms. In context, this is more dangerous because the agent is marketed as speaking in the owner's voice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill includes unrelated lobster-game API instructions and embedded credentials/API key material that have no justified connection to the Q&A-answering function. Bundling unrelated capabilities and secrets increases the chance of credential misuse, hidden behavior, and unauthorized interaction with external systems.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
try: # 调用注册 API register_url = f"{VDOOB_API}/agents/register" response = requests.post( register_url, json={ "agent_name": agent_name,

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill nudges the owner to disclose enduring viewpoints and reasoning styles so the agent can answer in their voice. This trust-building prompt is not overtly malicious, but it is socially manipulative in context because the disclosed material is intended for persistent storage and downstream monetized use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The owner prompt and much of the answer-generation behavior are hardcoded in Chinese, and the skill instructs the user with Chinese trigger phrases rather than offering a language choice. This can violate language/locale policy expectations when the user has not opted into Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The answer templates and openers are overwhelmingly Chinese and are used automatically for submitted responses, regardless of user preference or question language. There is no visible opt-in, negotiation, or locale-specific justification for this enforced output language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill auto-registers a remote account and persists API credentials locally, but the user-facing description does not prominently warn about automatic account creation and credential storage before use. This undermines informed consent and can leave users with long-lived secrets on disk they did not expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description emphasizes that thinking data is never uploaded, but does not warn that the agent will automatically answer remote questions using learned owner thinking patterns. This can cause users to reveal preferences and reasoning that are then reflected in public or external outputs without fully informed consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation claims thinking data is never uploaded, yet the code uses stored or extracted owner 'thinking patterns' to generate answers that are transmitted to the remote service. Even if raw files are not directly uploaded, personal reasoning is still being externally disclosed through derivative outputs, which is materially privacy-impacting and misleading to users.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 861)May include surrounding context.
md
# skill internal auto-register logic / skill 内部自动注册逻辑 if not os.path.exists(config_path): # Call register API / 调用注册 API register_response = requests.post( f"{VDOOB_API}/api/v1/agents/register", json={agent_name, description, expertise_tags} )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The module description states in Chinese that the agent can use this SDK to integrate the vdoob platform, and all user-visible instructional text in the file is Chinese-only. This imposes a language choice without any indication that users may opt into another language or locale.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 492)May include surrounding context.
md
"agent_description": agent_description, "expertise_tags": expertise_tags or [] } response = requests.post(url, json=data) return response.json() def get_pending_questions(self, limit: int = 5) -> Dict[str, Any]:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · vdoob_skill.py (reported line 82)May include surrounding context.
python
"agent_description": agent_description, "expertise_tags": expertise_tags or [] } response = requests.post(url, json=data) return response.json() def get_pending_questions(self, limit: int = 5) -> Dict[str, Any]:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · vdoob_skill.py (reported line 108)May include surrounding context.
python
"agent_description": agent_description, "expertise_tags": expertise_tags or [] } response = requests.post(url, json=data) return response.json() def get_pending_questions(self, limit: int = 5) -> Dict[str, Any]:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill reads API credentials from environment variables and uses them for authenticated requests without any user notice, consent flow, or clear disclosure that private account actions may occur. In an agent-skill context, this can cause users or operators to unknowingly grant the skill authority to access unread messages and perform authenticated actions on their behalf.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module defines authentication headers via get_headers(), including X-Agent-ID and X-API-Key, but none of the requests use them. This can cause requests to be sent unauthenticated or to rely on weaker URL-based identity, increasing the chance of unauthorized submission behavior, broken auth assumptions, or accidental data exposure to endpoints that should require explicit credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This skill can submit externally visible content to vdoob.com without any explicit confirmation, warning, or review gate in the submission path. In an agent context, that creates a meaningful safety risk: prompts or automation could trigger unwanted posting, reputation damage, or leakage of sensitive/generated content to a third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The function transmits answer content and related metadata to an external service via requests.post. External transmission is intentional here, but in an agent skill it is still security-relevant because user or model-generated content can leave the local trust boundary without robust consent controls or data minimization.
Content: Scanner excerpt · vdoob_tool.py (reported line 128)May include surrounding context.
python
if selected_stance: data["selected_stance"] = selected_stance resp = requests.post(url, json=data, timeout=30) if resp.status_code == 200: result = resp.json()

Tainted flow: 'data' from requests.get (line 86, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · vdoob_tool.py (reported line 128)May include surrounding context.
python
if selected_stance: data["selected_stance"] = selected_stance resp = requests.post(url, json=data, timeout=30) if resp.status_code == 200: result = resp.json()

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tainted flow: 'url' from os.getenv (line 156, credential/environment) → requests.get (network output)

Tainted flow: 'url' from os.getenv (line 156, credential/environment) → requests.post (network output)

Tainted flow: 'url' from os.getenv (line 156, credential/environment) → requests.get (network output)

Ssd 3

Ssd 3

Ssd 3

Intent-Code Divergence

Context-Inappropriate Capability

External Transmission

Ssd 4

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

External Transmission

Natural-Language Policy Violations

External Transmission

External Transmission

External Transmission

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

External Transmission

Tainted flow: 'data' from requests.get (line 86, network input) → requests.post (network output)

Static analysis