Security audit

Aicoo Group Chat

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent Aicoo group-chat API guide, but users should treat credentials, member changes, and join links carefully.

Install only if you want an agent to help operate Aicoo group chats. Confirm group IDs, member identities, removals, settings changes, and join-link sharing before running commands. Treat API keys, session cookies, and join links as sensitive because they can affect who can see or participate in conversations.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly documents generation and sharing of public join links but does not warn that possession of the link may grant access to a group conversation and its participants. In a messaging/group context, this omission can lead to unintended disclosure of private discussions or unauthorized membership if users or agents share links too broadly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow for creating a coordination group and adding members omits any caution that invited users are being added to a shared conversation and will receive notifications and future messages. This can cause privacy and consent issues, especially if an agent automatically groups users together without explicit user confirmation.

Static analysis

No suspicious patterns detected.