Security audit

Caspian

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with building messaging integrations, but it asks for sensitive account tokens in chat, enables billing automation, and recommends adding remotely fetched text to an agent system prompt.

Review before installing. Prefer OAuth flows where available, do not paste long-lived provider tokens into chat, pin the SDK version in a lockfile, require explicit approval before enabling autopay, and avoid putting remotely fetched behavior text directly into an agent system prompt.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:149
Finding: Untrusted Remote Content Can Be Appended to the Agent System Prompt
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:263
Finding: Reusable Third-Party Credentials Are Requested Through Agent Conversation and Relayed to a Hosted Gateway
Content: View full analysis
App Credentials -> copy Client ID, Client Secret, and Signing Secret, and paste all three to me. ``` Discord and Telegram bot tokens are handled similarly: ```text > Then paste me the token. ``` ```python client.connect_discord(bot_token="") ``` ```text > Open Telegram and message @BotFather. Send /newbot, choose a name and a > username, and paste me the token it gives you (looks like 7123456789:AAE...). ``` ```python telegram = client.connect_telegram(bot_token="") ``` Twilio and Telnyx account credentials are passed as plaintext arguments: ```text Ask for: Account SID + Auth Token (console.twilio.com) and your Twilio number (E.164). ``` ```python sms = client.connect_phone(provider="twilio", account_sid="AC...", auth_token="...", from_number="+1...") ``` ```text Ask for: API Key (portal.telnyx.com) and your Telnyx number (E.164). ``` ```python sms = client.connect_phone(provider="telnyx", api_key="KEY...", from_number="+1...") ``` X credentials are also requested and passed directly: ```text Ask the developer for their app's Access Token, Access Token Secret, and numeric user id (from developer.x.com, Keys & Tokens tab; App permissions "Read and write and Direct message"). ``` ```python x = client.connect_x( access_token="", access_secret="", user_id="", ) ``` ### Technical Analysis The Skill instructs developers to paste reusable Slack secrets, Discord and Telegram bot tokens, Twilio authentication tokens, Telnyx API keys, and X access credentials into an Agent conversation. These values are then supplied to `caspian-sdk` connectio ...[truncated 2697 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:104
Finding: Security-Sensitive SDK Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (36)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 55% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
Only offer those. Other channels (WhatsApp, Voice, RCS, Instagram, Facebook, iMessage) exist in the SDK but are NOT live on this gateway yet - do NOT try to connect them (they 400). If a developer asks for one of those, tell them it's "coming soon / being integrated" - don't attempt it and don't apologize at length; just say it's on the way. A channel may occasionally appear MORE THAN ONCE - each row is a different `provider` for that channel; when that happens, ask which provider they want and pass it as `provider=`

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The autopay instructions describe enabling future charges through an API call but do not require an explicit warning or confirmation that this authorizes ongoing billing. In an autonomous workflow, this could cause an agent to turn on financial commitments without sufficiently informed consent.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
## 3. Integrate - one handler for every channel The SDK reads CASPIAN_API_KEY and CASPIAN_BASE_URL from the environment or ./.env automatically. Write the handler ONCE; it fires for whatever channels you connect below.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill instructs the agent to ask the developer to paste highly sensitive X access credentials directly into the conversation. Collecting secrets through chat increases exposure risk through logs, transcript retention, and accidental disclosure to the model or downstream systems.
Content: Scanner excerpt · SKILL.md (reported line 504)May include surrounding context.
md
### b) Branded - bring your own account tokens Ask the developer for their app's Access Token, Access Token Secret, and numeric user id (from developer.x.com, Keys & Tokens tab; App permissions "Read and write and Direct message"). The user id is the part before the dash in the access token.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documentation normalizes deriving and handling sensitive token material in-band within the agent workflow. In conversational agent contexts, this creates unnecessary risk of secret leakage via logs, memory, or prompt reuse.
Content: Scanner excerpt · SKILL.md (reported line 506)May include surrounding context.
Ask the developer for their app's Access Token, Access Token Secret, and numeric user id (from developer.x.com, Keys & Tokens tab; App permissions "Read and write and Direct message"). The user id is the part before the dash in the access token.

python
x = client.connect_x(

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The example code shows raw access tokens being passed directly, reinforcing a workflow where secrets are supplied openly to the agent. If such tokens are captured, an attacker could control the connected X account within the granted permissions.
Content: Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.
python
x = client.connect_x( access_token="<Access Token>", access_secret="<Access Token Secret>", user_id="<numeric user id>", )

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: Passing an access secret directly in the documented flow exposes a long-lived secret to the conversational and logging surface. In this context, the skill is encouraging unsafe credential handling practices for a sensitive third-party account.
Content: Scanner excerpt · SKILL.md (reported line 511)May include surrounding context.
python
x = client.connect_x( access_token="<Access Token>", access_secret="<Access Token Secret>", user_id="<numeric user id>", )

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 389)May include surrounding context.
md
1. Do steps 1-3 below (key, install, the shared handler) - always needed. 2. Discover which channels are actually connectable RIGHT NOW: `curl -s https://api.trycaspianai.com/v1/channels -H "Authorization: Bearer $CASPIAN_API_KEY"` That returns the live channels (currently: email, discord, slack, x, telegram, phone/SMS). Phone/SMS is BRING-YOUR-OWN (the developer's own Twilio/Telnyx number - see that section).

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:511