T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_x_search.mjs:63- Finding
Bearer Credential Disclosure Through an Unrestricted API Base Override
- Content
View full analysis
- Remediation
View remediation
Security audit
Felo X Search
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it can send the user's Felo API key to an arbitrary API base URL if the environment is influenced, and it recommends an unpinned global npm install.
Install only if you are comfortable sending X/Twitter search inputs to Felo. Prefer the bundled script over the unpinned global npm install, keep FELO_API_BASE unset unless you fully control and trust the endpoint, and use a Felo API key with limited scope or revocability where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:56- Finding
Unpinned Global Installation of an External npm Package
- Content
View full analysis
- Remediation
View remediation
``` 3. Publish and verify package integrity information and provenance. 4. Avoid global installation where possible. Use a project-local dependency in an isolated environment. 5. Audit the pinned package, its lockfile, transitive dependencies, and lifecycle scripts before recommending it. 6. Use lockfiles and automated dependency scanning for reproducible installations. 7. Consider disabling lifecycle scripts where compatible: ```bash npm install --ignore-scripts felo-ai@ ``` 8. Update the documentation to distinguish clearly between the locally audited script and the external npm package, which is outside the Skill’s audit boundary. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes broad natural-language phrases like "twitter," "tweet," and "tweets from," which can cause the agent to invoke this skill in situations where the user did not clearly request an external X/Twitter lookup. In an agent setting, overly broad activation increases the chance of unintended data transmission to the external Felo API and tool misuse outside the intended scope.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documentation describes use of environment variables and outbound network access, but it does not declare any corresponding tool scope such as allowed-tools or permissions. This creates a least-privilege and review gap: a host agent may enable broader capabilities than users or auditors expect, making secret access and external calls harder to govern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
|
-j, --json| Output raw JSON | |-t, --timeout <seconds>| Timeout in seconds (default: 30) |Option B: Call API with curl
bash # Search tweets
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README states that the skill searches tweets, users, and replies via the Felo X Search API, but it does not explicitly warn that user queries, usernames, tweet IDs, or related inputs may be transmitted to a third-party service. This omission can lead to privacy surprises and unintended disclosure of user-supplied data, especially when combined with automatic agent invocation.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/run_x_search.mjs:250