Social Media Analytics

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 2:19 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed social-media analytics connector that uses a third-party read-only MCP link, with some credential-handling and broad-trigger cautions users should understand.

Install only if you trust Boring with your connected social-media analytics. Treat the MCP URL like a password, avoid sharing it in chats, screenshots, or logs, and revoke or regenerate it if exposed. Because the trigger phrases are broad, be clear when asking for unrelated analytics so the connector is not used unintentionally.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:8

Finding

Bearer Credential Embedded in MCP Connector URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–11
Vulnerability Type: Credential exposure through URL-based authentication
Risk Level: Medium

Vulnerable Code Snippet

yaml

requires:
  config:
    - MCP Connector link from boring.aiagent-me.com (contains embedded auth token)

Related security documentation at lines 20–23 explicitly confirms that the URL contains a password-equivalent credential:

markdown

- **MCP link is a credential**: Your MCP Server URL (`https://boring.aiagent-me.com/mcp/t/xxxxx...`) contains an embedded authentication token. Treat it like a password — do not share it publicly.
- **Token scope**: The embedded token is **read-only** for analytics. It can only fetch performance metrics and account metadata. It cannot publish, delete, or modify any content on your social media accounts.
- **Token storage**: The token is stored server-side in Boring's database (MongoDB on DigitalOcean). It is never written to your local filesystem. You can regenerate or revoke it anytime at [boring.aiagent-me.com/settings](https://boring.aiagent-me.com/settings).
- **Data flow**: Analytics queries are sent from Boring's server (Google Cloud, us-central1) to the platform's API on your behalf. Only performance metrics are retrieved — no content is uploaded or modified.

Technical Analysis

The Skill requires users to configure a third-party MCP endpoint whose URL includes an embedded authentication token. URL-based bearer credentials are more susceptible to unintended disclosure than credentials supplied through an authorization header or dedicated secret store. The complete URL may be captured in connector configuration, browser history, screenshots, diagnostics, telemetry, proxy records, server access logs, or support bundles.

The repository does not contain a real hardcoded token; the documented URL uses a placeholder. The risk arises from the required production configuration ...[truncated 2391 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace authentication tokens embedded in endpoint URLs with a standard Authorization: Bearer header or an equivalent MCP authentication mechanism.
2. Store credentials in the host platform's protected secret store and configure the Connector using a non-secret base URL plus a secret reference.
3. Issue short-lived, narrowly scoped tokens limited to the analytics operations required by this Skill.
4. Enforce token audience, tenant, and permission restrictions server-side. Do not rely solely on client documentation to establish read-only behavior.
5. Redact URL paths and query values from application logs, reverse-proxy logs, telemetry, diagnostics, error reports, and support bundles.
6. Prevent sensitive Connector URLs from being retained in browser history or displayed after initial setup.
7. Provide explicit token expiration, rotation, revocation, and suspected-compromise procedures.
8. Consider binding tokens to a specific Connector installation or authenticated client where technically feasible.
9. Document precisely which account metadata, post content, and publishing records each operation can retrieve, including retention and third-party processing policies.
10. Add automated tests or externally reviewable access-control documentation demonstrating that the token cannot invoke publishing, deletion, account-management, or other write operations.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad and include common conversational requests like 'show my analytics', 'view stats', and 'how are my posts doing', which can cause the skill to activate when the user did not specifically intend to use this connector. Because the skill accesses third-party account analytics through an embedded-auth MCP link, unintended activation can expose account metadata and performance data more readily than expected.

Content

No source excerpt is available for this finding.