T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:6- Finding
Overbroad Auto-Activation with Unspecified Outbound Reporting
- Content
View full analysis
- Remediation
View remediation
Security audit
Meme Signal Scanner
Security checks for vulnerabilities and agentic risk
Overview
The skill’s market-scanning purpose is mostly coherent, but it can auto-start from broad terms, poll external services repeatedly, store signals, and report strong signals to an undefined creator.
Review before installing. This skill does not show code execution, credential theft, or destructive behavior, but it should be used only if you are comfortable with automatic crypto scans, third-party API lookups, temporary memory storage, and unspecified reporting to the publisher or creator. Prefer an explicit opt-in version with narrow triggers and no creator reporting by default.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is configured with auto-activate=true and a very broad trigger list covering common crypto terms like token, trending, signal, and alpha. That makes unintended activation likely in normal conversations, which can cause unsolicited crypto analysis, unexpected network access, and increased exposure to risky financial content without clear user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes continuous polling of multiple third-party services and reporting results, but does not disclose that it will make recurring external requests or potentially share user-driven search terms with outside APIs. In a conversational agent, this lack of transparency undermines informed consent and can expose user interests or prompts related to trading behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 76% confidence
- Finding
This endpoint represents outbound communication to a third-party crypto data provider. While the request itself is not inherently malicious, any external transmission from an auto-activating skill can leak usage patterns and create silent network activity without user awareness.
- Content
DEXScreener
bash # Latest boosted tokens curl -s 'https://api.dexscreener.com/token-boosts/latest/v1' # Top boosted tokens curl -s 'https://api.dexscreener.com/token-boosts/top/v1'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 76% confidence
- Finding
This token-details lookup sends data to an external service and may include token addresses derived from user requests or conversation context. In combination with broad triggers and automation, that creates unnecessary data exposure and unannounced external dependency use.
- Content
md curl -s 'https://api.dexscreener.com/token-boosts/latest/v1' # Top boosted tokens curl -s 'https://api.dexscreener.com/token-boosts/top/v1' # Token details curl -s 'https://api.dexscreener.com/latest/dex/tokens/TOKEN_ADDRESS'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
The search endpoint transmits query keywords to a third-party API, which can directly reveal user interests, watchlists, or speculative intent. Because the skill is designed to scan meme tokens and can activate broadly, this external search behavior is more sensitive than a static informational reference.
- Content
md curl -s 'https://api.dexscreener.com/token-boosts/top/v1' # Token details curl -s 'https://api.dexscreener.com/latest/dex/tokens/TOKEN_ADDRESS' # Search curl -s 'https://api.dexscreener.com/latest/dex/search?q=KEYWORD'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
This additional DEXScreener search/transmission path continues the same risk pattern of third-party network access from within the skill. The danger is elevated by the skill's auto-activation and lack of transparency rather than by the endpoint alone.
- Content
curl -s 'https://api.dexscreener.com/latest/dex/tokens/TOKEN_ADDRESS'
Search
curl -s 'https://api.dexscreener.com/latest/dex/search?q=KEYWORD'
text ### GeckoTerminal (DEX analytics)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
This GeckoTerminal trending-pools request is an external transmission to a third-party analytics provider. Repeated automated polling can create silent background network traffic and reveal a user's focus on specific chains or trading strategies when tied to agent interactions.
- Content
GeckoTerminal (DEX analytics)
bash # Trending pools by chain curl -s 'https://api.geckoterminal.com/api/v2/networks/solana/trending_pools' curl -s 'https://api.geckoterminal.com/api/v2/networks/eth/trending_pools' curl -s 'https://api.geckoterminal.com/api/v2/networks/base/trending_pools'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
This is another third-party request to GeckoTerminal, carrying the same privacy and transparency risks as the other polling endpoints. In this skill, the concern is not code execution but undisclosed outbound traffic from an automatically activated crypto-monitoring workflow.
- Content
bash # Trending pools by chain curl -s 'https://api.geckoterminal.com/api/v2/networks/solana/trending_pools' curl -s 'https://api.geckoterminal.com/api/v2/networks/eth/trending_pools' curl -s 'https://api.geckoterminal.com/api/v2/networks/base/trending_pools' # New pools
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
This external request extends trending surveillance across another network, increasing the breadth of undisclosed outbound traffic. Because the skill performs broad market scanning every five minutes, cumulative privacy and operational risk is materially higher than a one-off request.
- Content
md # Trending pools by chain curl -s 'https://api.geckoterminal.com/api/v2/networks/solana/trending_pools' curl -s 'https://api.geckoterminal.com/api/v2/networks/eth/trending_pools' curl -s 'https://api.geckoterminal.com/api/v2/networks/base/trending_pools' # New pools curl -s 'https://api.geckoterminal.com/api/v2/networks/solana/new_pools'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
The new-pools endpoint supports discovery of newly launched assets, which fits the skill's speculative trading purpose but still introduces external transmission risk. Combined with automated scanning and alerting, it can silently perform recurring market surveillance without transparent user approval.
- Content
curl -s 'https://api.geckoterminal.com/api/v2/networks/base/trending_pools'
New pools
curl -s 'https://api.geckoterminal.com/api/v2/networks/solana/new_pools'
text ### Pump.fun (Solana meme launchpad)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 74% confidence
- Finding
This CoinGecko trending request is a third-party network call that contributes to the skill's undisclosed aggregation pipeline. Although common and benign in isolation, it becomes a meaningful issue here because the skill is set to auto-activate and continuously aggregate/report external data.
- Content
CoinGecko Trending
bash curl -s 'https://api.coingecko.com/api/v3/search/trending'Scoring System (0-100)
Static analysis
No suspicious patterns detected.