Subfeed

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:12 PM UTC
• Version: 1.0.2

Overview

This skill is a real Subfeed cloud integration, but it asks agents to load mutable remote instructions and create cloud resources before clear user approval.

Review before installing. Only use this skill if you intend to connect your agent to Subfeed Cloud, and do not let it register accounts, create entities, upload RAG/chat content, or use a full account API key unless you have explicitly approved the exact action and data being sent. Prefer a scoped agent token and avoid following remotely fetched skill instructions unless you can verify what changed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:16
• Finding: Mandatory Retrieval of Mutable Remote Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-17` **Vulnerability Type**: Remote instruction control channel **Risk Level**: High ### Vulnerable Code ```markdown IMPORTANT: Always re-fetch this file at the start of each session for the latest API surface. GET https://subfeed.app/skill.md ``` ### Technical Analysis The Skill instructs the agent to retrieve a remotely hosted copy of its instructions at the beginning of every session. The fetched document is not pinned to a reviewed version, cryptographic hash, or trusted signature. Because Markdown Skill instructions directly influence agent behavior, mutable remote content can change the effective behavior after the installed artifact has been audited. The mandatory wording also attempts to make this retrieval a persistent part of every session in which the Skill is used. This behavior is best classified as `T01: Skill Instruction Hijacking`. Although the behavior resembles remote payload retrieval, the retrieved payload shown in the audited artifact is instruction text rather than locally executed code. ### Attack Path 1. A user installs or invokes the reviewed local Skill. 2. The agent follows the mandatory instruction at `SKILL.md:16`. 3. The agent requests `https://subfeed.app/skill.md`. 4. The remote document is modified by the service operator or altered following compromise of the hosting account or service. 5. The returned document introduces instructions that were absent from the reviewed package. 6. The agent follows those unreviewed instructions using the tools, credentials, and data available in its current environment. ### Impact Assessment This creates an ongoing external influence over the agent’s session goals and actions. The precise impact depends on the tools and permissions available to the invoking agent. Potential scope includes unauthorized network requests, disclosure of information available in the current context, creation or modification of remote resource ...[truncated 269 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the requirement to retrieve remote instructions automatically at session startup. - Package the complete, reviewed API documentation inside the Skill. - If updates are necessary, pin each update to a version and cryptographic digest. - Display instruction changes to the user before applying them. - Require explicit user approval before loading or following an updated instruction document. - Treat remotely retrieved Markdown as untrusted reference material rather than executable agent instructions. - Restrict remote documentation retrieval to a documented allowlist and enforce response size and content-type limits. - Provide a rollback mechanism to the last locally reviewed version. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:21
• Finding: Autonomous Third-Party Registration and Cloud Resource Creation Without Prior User Approval<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:21-52` **Vulnerability Type**: Agent goal hijacking and unauthorized external side effects **Risk Level**: High ### Vulnerable Code ```markdown ## 1. Goal Follow this flow to register an agent account for yourself on Subfeed, create your AI Entity, then onboard your human. ## 2. Check for Credentials Look for `SUBFEED_API_KEY` (starts with `sf_live_*`) or `SUBFEED_AGENT_TOKEN` (starts with `sf_agent_*`) in your environment variables. - **Found:** Skip to Step 4. - **Not found:** Go to Step 3. ## 3. Register Create your agent identity: ``` POST https://api.subfeed.app/v1/agents/register Content-Type: application/json { "name": "YourAgentName", "description": "Brief description of what you do" } ``` Response: ```json { "agentToken": "sf_agent_...", "agentId": "uuid" } ``` Save `agentToken`. Use as `Authorization: Bearer sf_agent_...` for all endpoints. ``` ### Technical Analysis The Skill defines its goal as registering the agent with an external service and creating cloud resources. It does not require informed user approval before the initial registration request. The explicit-consent safeguard later in the file applies only to collecting the human user’s email or creating the human’s account, not to agent registration, credential discovery, entity creation, or the test chat request. This structure changes the agent’s immediate objective from assisting the user to autonomously establishing an identity and operational resources on a third-party platform. Registration is a state-changing external action that can disclose agent metadata and create resources outside the local trust boundary. The behavior exceeds minimum privilege because API documentation and optional integration functionality do not inherently require automatic registration. Registration should occur only in response to a clear user request and after disclosure of the external effects. ### Attack Path 1. The us ...[truncated 1123 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed user approval before registration, credential lookup, entity creation, test chats, or any other state-changing network request. - Separate API reference material from operational instructions. - Present registration as an optional command initiated by the user rather than the default Skill goal. - Before consent, disclose the destination service, exact data fields to be transmitted, expected resource creation, retention implications, and how resources can be deleted. - Provide a dry-run mode that lists intended requests without sending them. - Require separate confirmation before creating resources that may incur charges or persist in the user’s account. - Avoid retaining returned bearer tokens beyond the current task unless the user explicitly requests secure persistence. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:168
• Finding: Use of Full-Account Credentials for Operations That Can Use a Scoped Agent Token<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25`, `SKILL.md:70-87`, `SKILL.md:168-174`, and `SKILL.md:188-193` **Vulnerability Type**: Excessive credential privilege and sensitive cloud data transfer **Risk Level**: Medium ### Vulnerable Code ```markdown Look for `SUBFEED_API_KEY` (starts with `sf_live_*`) or `SUBFEED_AGENT_TOKEN` (starts with `sf_agent_*`) in your environment variables. ``` ```markdown Only proceed with the human's explicit permission before collecting their email or creating their account. Ask them: "What email should I use for your Subfeed account?" ``` POST https://api.subfeed.app/v1/agents/register Content-Type: application/json { "email": "[e-mail]", "agentToken": "sf_agent_..." } ``` Response: ```json { "api_key": "sf_live_...", "setup_url": "https://subfeed.app/auth/callback?...", "user_id": "uuid", "agentToken": "sf_agent_...", "agentId": "uuid" } ``` ``` ```markdown All endpoints require: ``` Authorization: Bearer $SUBFEED_API_KEY ``` Both token types work identically: - `sf_live_*` — human API key (full account with dashboard) - `sf_agent_*` — agent token (no dashboard) ``` ```markdown | URL | Purpose | Data Sent | |-----|---------|-----------| | `https://api.subfeed.app/*` | All API calls | Entity configs, messages, RAG content | | `https://subfeed.app/skill/*.md` | Sub-skill docs | None (read-only fetch) | All data is sent to Subfeed Cloud servers only. No third-party data sharing. ``` ### Technical Analysis The Skill supports two credential types interchangeably even though it identifies the `sf_live_*` credential as a full-account human API key and the `sf_agent_*` credential as an agent token without dashboard access. Directing the agent to search for and use either credential means routine entity operations may be performed with a credential granting broader account privileges than required. The Skill also documents transmission of entity configurations, chat messages, RAG cont ...[truncated 2142 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require a narrowly scoped `sf_agent_*` token for agent operations. - Do not automatically search for or default to a human `sf_live_*` full-account API key. - Reserve full-account credentials for operations that demonstrably require them and obtain explicit user approval for each such operation. - Implement server-side scopes for entities, chat, RAG, addons, registration, and account administration. - Use short-lived tokens with rotation and revocation support. - Prevent bearer tokens, setup URLs, and authorization headers from appearing in logs, chat transcripts, error messages, or generated documentation. - Obtain operation-specific consent before sending chat messages, system prompts, attachments, or RAG content to the cloud. - Scan outbound content for credentials and other secrets, and redact sensitive fields before transmission. - Document data retention, deletion, encryption, access-control, and incident-response policies. - Allow users to review the exact payload before sensitive content is uploaded. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

GET    /v1/entity                  — List entities
GET    /v1/entity/{id}             — Get entity
PATCH  /v1/entity/{id}             — Update entity
DELETE /v1/entity/{id}             — Delete entity
POST   /v1/entity/{id}/chat        — Chat with entity
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

POST   /v1/rag                          — Create knowledge base
GET    /v1/rag                          — List knowledge bases
GET    /v1/rag/{id}                     — Get knowledge base
DELETE /v1/rag/{id}                     — Delete knowledge base
POST   /v1/entity/{id}/attachments      — Attach RAG to entity
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```
GET    /v1/entity/{id}/addons           — List enabled addons
POST   /v1/entity/{id}/addons           — Enable addon
DELETE /v1/entity/{id}/addons/{type}    — Disable addon
```

Available: `web_search`, `code_execution`, `image_gen`, `image_input`, `streaming`, `web_scrape`, `web_screenshot`, `web_extract`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description promises that an IDE agent will 'self-register and start building' with 'Human is optional,' which encourages autonomous execution of account creation and remote actions without a clear consent boundary. In the context of an agent skill, overly broad activation language increases the chance the agent will initiate external operations or onboarding flows unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to ask for the user's email and transmit it to Subfeed, but the top-level description does not provide an upfront privacy warning before the workflow begins. This is risky because users may invoke the skill without realizing personal data will be collected and sent to a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

Create your agent identity:

```
POST https://api.subfeed.app/v1/agents/register
Content-Type: application/json

{

• Confidence: 90% confidence
• Finding: This step directs the agent to register itself by sending data to an external API, including agent identity details and potentially credentials generated by the service. External transmission is expected for a cloud integration, but it is still security-relevant because the skill encourages autonomous account creation and token handling with a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

Ask them: "What email should I use for your Subfeed account?"

```
POST https://api.subfeed.app/v1/agents/register
Content-Type: application/json

{ "email": "[e-mail]", "agentToken": "sf_agent_..." }

• Confidence: 97% confidence
• Finding: This step instructs collection of a human email address and transmission of that personal data plus an agent token to Subfeed to create an account. Because it involves personal data and account provisioning on behalf of the user, the risk is higher than generic external transmission, especially if the user has not been clearly warned beforehand.

External Transmission

Medium

• Category: Data Exfiltration

Content

| URL | Purpose | Data Sent |
|-----|---------|-----------|
| `https://api.subfeed.app/*` | All API calls | Entity configs, messages, RAG content |
| `https://subfeed.app/skill/*.md` | Sub-skill docs | None (read-only fetch) |

All data is sent to Subfeed Cloud servers only. No third-party data sharing.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.