Security audit

Byted Viking Knowledgebase

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Viking knowledge-base search helper, but it sends user queries and an API token over unencrypted HTTP and may activate too broadly.

Install only after reviewing the code and preferably after the publisher switches all requests to HTTPS, narrows activation to explicit Viking knowledge-base searches, documents the exact environment variables and transmitted data, and pins or removes dependencies. Treat search queries as sensitive because they are sent to an external service.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs use of environment-stored API credentials and a Python script that performs external knowledge-base queries, which implies access to both secrets and the network, yet no corresponding permissions are declared. This creates a transparency and consent gap: an agent may invoke external requests with sensitive credentials without an explicit permission boundary or user awareness.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger condition is overly broad: the skill says it should be used by default whenever the user mentions a knowledge base. This can cause unintended activation in unrelated contexts, leading to unnecessary external lookups, possible disclosure of user prompts to a third-party service, and surprise use of configured credentials.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The request is explicitly configured to use HTTP via `r.set_shema("http")` and `url="http://..."`, so user queries and server responses transit the network unencrypted. This exposes potentially sensitive knowledge-base queries, returned content, and the bearer token in the Authorization header to interception or modification by anyone on the network path.

Unpinned Dependencies

Low

Category: Supply Chain
Content: volcengine aiohttp
Confidence: 91% confidence
Finding: The dependency 'volcengine' is unpinned, so installs may resolve to different versions over time. This creates supply-chain risk and can unexpectedly introduce breaking changes or newly published malicious or vulnerable releases into the skill environment.

Unpinned Dependencies

Low

Category: Supply Chain
Content: volcengine aiohttp
Confidence: 98% confidence
Finding: The dependency 'aiohttp' is unpinned, which allows future installs to pull arbitrary newer versions, including versions with known security defects or incompatible behavior. Because this package is network-facing and often processes HTTP input, version drift is more dangerous than for purely local libraries.

Known Vulnerable Dependency: aiohttp — 10 advisory(ies): CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The requirements file includes 'aiohttp' without a version, and static analysis indicates multiple known advisories affect this dependency. In a skill that interacts with a knowledge base service, a vulnerable HTTP client/server library can expose the agent to memory exhaustion, header injection, request handling flaws, or other network-triggered issues depending on how the package is used.

Static analysis

No suspicious patterns detected.