AI UGC

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:04 PM UTC
• Version: 0.0.4

Overview

This is a coherent RawUGC API helper, but it exposes public posting, account disconnection, deletion, uploads, and external media analysis without enough built-in confirmation or privacy guidance.

Install only if you are comfortable giving the agent access to your RawUGC API key and RawUGC-connected social accounts. Before using it, require explicit confirmation for deletes, account disconnects, scheduling changes, and any publish-now action, and avoid uploading sensitive media because uploaded files may become public URLs and are processed by RawUGC.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

A raw DELETE endpoint for personas is exposed with no guardrails around parameter validation beyond the path identifier and no procedural safety checks for destructive execution. In practice, an agent could delete the wrong persona due to prompt ambiguity, stale identifiers, or malicious prompt steering, causing irreversible business-data loss.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md

- **POST /personas** -- Create. Body: `name` (required, max 200), `description` (required, max 5000). Returns `id`.
- **GET /personas/:personaId** -- Get one.
- **PATCH /personas/:personaId** -- Update. Body: `name`, `description` (both optional).
- **DELETE /personas/:personaId** -- Delete.

**PersonaResponse**: `_id`, `organizationId`, `name`, `description`, `createdAt`, `updatedAt`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The messaging DELETE operation allows irreversible removal of brand messaging templates, yet the skill provides no safety procedure to ensure the selected message is the intended target. This makes prompt confusion or malicious instruction injection more likely to result in accidental deletion of important marketing assets.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

md

- **POST /messaging** -- Create. Body: `name` (required, max 200), `body` (required, max 5000). Returns `id`.
- **GET /messaging/:messageId** -- Get one.
- **PATCH /messaging/:messageId** -- Update. Body: `name`, `body` (both optional).
- **DELETE /messaging/:messageId** -- Delete.

**MessagingResponse**: `_id`, `organizationId`, `name`, `body`, `createdAt`, `updatedAt`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The product deletion endpoint enables removal of product records that may be reused across content generation workflows, but the skill does not require confirmation or contextual validation. An agent acting on an imprecise request could destroy shared product configuration and disrupt downstream automations.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

- **POST /products** -- Create. Body: `name` (required, max 200), `photos` (required, URL array), `description` (max 1000), `messaging` (max 5000). Returns `id`.
- **GET /products/:productId** -- Get one.
- **PATCH /products/:productId** -- Update. Body: `name`, `description`, `photos`, `messaging` (all optional).
- **DELETE /products/:productId** -- Delete.

**ProductResponse**: `_id`, `name`, `description`, `photos`, `messaging`, `createdAt`, `updatedAt`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The style deletion endpoint removes creative styles and prompt templates that may influence future generated content, but the skill lacks safeguards against accidental or adversarial parameter selection. This can lead to loss of reusable configuration and degraded content workflows.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md

- **POST /styles** -- Create. Body: `name` (required, max 200), `description` (max 1000), `type` (`video`/`image`), `aspectRatio` (`portrait`/`landscape`/`square`), `promptTemplate` (max 5000, supports `{productName}`, `{messaging}`, `{character}` placeholders). Returns `id`.
- **GET /styles/:styleId** -- Get one.
- **PATCH /styles/:styleId** -- Update. All fields optional.
- **DELETE /styles/:styleId** -- Delete.

**StyleResponse**: `_id`, `name`, `description`, `type`, `aspectRatio`, `styleId`, `promptTemplate`, `isAdmin`, `isStandard`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Disconnecting a social account is a high-risk state-changing action that can interrupt publishing pipelines and revoke access to connected channels. Because the skill exposes the endpoint without strong execution constraints, an agent could disconnect the wrong account through ambiguity or malicious prompting.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

Sync connected accounts from the scheduling provider. Returns `{ success: boolean }`.

### DELETE /social/accounts/:accountId

Disconnect a social account. Returns `{ success: boolean }`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Deleting a scheduled or draft social post is an irreversible operational action, and the skill does not instruct the agent to validate the target or seek confirmation first. In a social publishing context, mistakes can cause lost campaign content, missed schedules, or business disruption.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md

Update a post. Body: `content`, `scheduledFor`, `timezone`, `accountIds` (at least one field required).

### DELETE /social/posts/:postId

Delete a post. Returns `{ success: boolean }`.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 133)May include surrounding context.

md

**Request**: `name`?, `description`?

### DELETE /personas/{personaId}

**PersonaResponse**: `_id`, `organizationId`, `name`, `description`, `createdAt`, `updatedAt`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 157)May include surrounding context.

md

**Request**: `name`?, `body`?

### DELETE /messaging/{messageId}

**MessagingResponse**: `_id`, `organizationId`, `name`, `body`, `createdAt`, `updatedAt`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 181)May include surrounding context.

md

**Request**: `name`?, `description`?, `photos`?, `messaging`?

### DELETE /products/{productId}

**ProductResponse**: `_id`, `name`, `description`, `photos`, `messaging`, `createdAt`, `updatedAt`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 207)May include surrounding context.

md

**Request**: `name`?, `description`?, `aspectRatio`?, `promptTemplate`?

### DELETE /styles/{styleId}

**StyleResponse**: `_id`, `name`, `description`, `type`, `aspectRatio`, `styleId`, `promptTemplate`, `isAdmin`, `isStandard`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 223)May include surrounding context.

md

Sync accounts from scheduling provider. **Response 200**: `{ success }`

### DELETE /social/accounts/{accountId}

**Response 200**: `{ success }`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 251)May include surrounding context.

md

**Request**: `content`?, `scheduledFor`?, `timezone`?, `accountIds`? (at least one field)

### DELETE /social/posts/{postId}

**Response 200**: `{ success }`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The upload section tells the agent how to send user media to an external API but omits a privacy warning that files leave the local environment and are transmitted to a third party. Users may not realize sensitive videos or images are being externally processed, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes destructive DELETE operations for personas without requiring an explicit user-confirmation step or warning that data will be permanently removed. In an agent setting, ambiguous user requests like 'clean up personas' could be translated into irreversible API calls, causing unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documents account disconnection, post deletion, and immediate publishing capabilities without cautioning the agent to obtain explicit approval before taking those actions. This creates a real risk of unauthorized social account changes or accidental publication/deletion triggered by misunderstood prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The TikTok scraping and external video analysis features involve collecting third-party content and sending URLs/media for analysis, but the skill omits privacy and data-use warnings. In an agent workflow, this can lead to silent collection or processing of personal or copyrighted content without the user's informed awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The upload endpoint explicitly returns a public URL for uploaded media, but the reference does not warn that uploaded files become publicly accessible. In an agent skill, this omission is dangerous because users may upload sensitive or copyrighted media assuming normal API confidentiality, and the agent could then propagate or reuse a public URL that anyone with the link can access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.