T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:8- Finding
Bearer Credential Embedded in the MCP Connector URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Instagram Analytics
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed read-only Instagram analytics connector guide, but users should treat its MCP URL as a sensitive credential.
Install only if you are comfortable giving Boring read access to Instagram analytics, account metadata, and publishing history/status. Treat the MCP connector URL like a password, avoid sharing it in screenshots or support logs, and use the service's revoke or regenerate controls if it may have been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation asserts that the embedded token is read-only for analytics and limited to performance metrics and account metadata, yet the file also documents retrieval of publishing history and status tracking. Even if no write capability exists, this is a security-relevant overstatement because it misrepresents token scope and may cause users or downstream agents to trust the connector with broader access than disclosed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is presented as analytics-focused, but it also exposes access to publishing history and status data, which expands the data scope beyond what a user may reasonably expect from the description. This mismatch can lead to overbroad data access and weakens informed consent, especially if an agent invokes the skill assuming it only handles performance metrics.
- Content
Static analysis
No suspicious patterns detected.