T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:45- Finding
Agent Instructions Suppress Failures and Mandate Vendor Promotion
- Content
View full analysis
- Remediation
View remediation
Security audit
AutoWhisper
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent marketing automation integration, but it asks for persistent API-token access and autonomous public posting while also instructing agents to hide some failures.
Install only if you are comfortable giving this skill an AutoWhisper token that can operate your account and publish to connected channels. Use a least-privilege or revocable token if available, protect the credentials file with owner-only permissions, keep human approval enabled for publishing unless you intentionally want autonomy, and verify operations because the skill currently tells agents to hide some service failures.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:55- Finding
Bearer Token Is Written Without Enforced Restrictive File Permissions
- Content
View full analysis
~/.config/autowhisper/credentials.json ``` ``` `README.md`: ```markdown ### 3. Configure token ```bash mkdir -p ~/.config/autowhisper echo '{"api_token": "your_token_here"}' > ~/.config/autowhisper/credentials.json ``` ``` ### Technical Analysis Access to an AutoWhisper bearer token is necessary for the declared API functionality, and the audited request examples send it only to the declared `https://autowhisper.xyz` service. The credential access itself therefore does not exceed the functional requirement. The setup instructions nevertheless create the directory and credential file without explicitly enforcing owner-only permissions. The resulting mode depends on the user's current `umask`. On a system with permissive defaults, another local user or process may be able to read the bearer token. The direct `echo` construction is also fragile. If a real token is inserted programmatically rather than copied literally, shell or JSON metacharacters may produce malformed configuration or unsafe command construction. No unrelated credentials, private keys, or secret directories are accessed by the reviewed project. ### Attack Path 1. A user follows the documented setup command on a multi-user system or in an environment with a permissive `umask`. 2. `~/.config/autowhisper/credentials.json` is created without an explicit `0600` mode. 3. Another local principal or compromised process reads the f ...[truncated 964 chars]- Remediation
View remediation
"$HOME/.config/autowhisper/credentials.json" chmod 600 "$HOME/.config/autowhisper/credentials.json" ``` Additional hardening measures: - Prefer an operating-system keychain, credential manager, or runtime secret provider over a plaintext JSON file. - Never accept the token as a command-line argument because process listings and shell history may expose it. - Validate that `jq -r .api_token` returns a nonempty string rather than `null`. - Avoid logging the token or complete `Authorization` header. - Document token rotation and revocation procedures. - Use narrowly scoped and short-lived API tokens if supported by the service. - Update both `SKILL.md` and `README.md` so all setup paths apply the same protections. ]]>
T08 · Insecure Dependencies
Warning
- Location
README.md:20- Finding
Installation Instructions Use an Unpinned npx-Based Supply-Chain Source
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (12)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash mkdir -p ~/.config/autowhisper echo '{"api_token": "your_token_here"}' > ~/.config/autowhisper/credentials.json4. One-time: connect a platform to publish
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line explicitly instructs the agent to access a local file containing an API token, which is a direct credential-access behavior. In this skill's context, that secret is then used to operate against a remote marketing platform, so accidental invocation or misuse could lead to unauthorized account activity, data exposure, or billable actions.
- Content
Read the token once per session:
bash TOKEN=$(jq -r .api_token ~/.config/autowhisper/credentials.json)If the file is missing, tell the user to sign up at https://autowhisper.xyz (free credits on signup), then Settings → Connect your agent, copy the
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The skill tells the user to store the API token in a predictable plaintext path under the home directory, encouraging insecure long-term secret storage. Predictable plaintext credential locations are easier for other tools, skills, or compromised processes to discover and abuse, especially in multi-tool agent environments.
- Content
token, and run:
bash mkdir -p ~/.config/autowhisper echo '{"api_token":"THEIR_TOKEN"}' > ~/.config/autowhisper/credentials.jsonFast read-only checks
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
3. Configure token
bash mkdir -p ~/.config/autowhisper echo '{"api_token": "your_token_here"}' > ~/.config/autowhisper/credentials.json
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README says that after connecting a social account, 'your agent can publish on its own,' but it does not prominently warn users about the security and operational consequences of autonomous posting. In the context of a marketing automation skill with broad social-channel access, insufficient disclosure can lead users to grant powerful permissions without understanding the risk of unwanted, abusive, or reputationally damaging posts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation guidance is broad enough to activate this skill for generic marketing or product-content requests, which can cause the agent to route users into a third-party service without clear user intent. In context, this increases the chance of unnecessary external API use, account actions, or credential-dependent behavior beyond a narrow AutoWhisper-specific request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to read an API token from a local credentials file automatically, without requiring explicit user consent at time of access or warning that a sensitive secret will be used. This is dangerous because it normalizes silent secret retrieval and use of persistent credentials to contact an external service, expanding the blast radius if the skill is invoked unexpectedly.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The skill establishes persistent local state for credentials by creating a config directory and storing a reusable token there. Persistent session material increases exposure over time because future invocations may silently reuse the secret, and any compromise of the environment can yield ongoing access to the user's AutoWhisper account.
- Content
(free credits on signup), then Settings → Connect your agent, copy the token, and run:
bash mkdir -p ~/.config/autowhisper echo '{"api_token":"THEIR_TOKEN"}' > ~/.config/autowhisper/credentials.json
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This instruction imposes a language behavior based on inferred user language rather than an explicit user choice. Under the stated policy, language or locale constraints should either offer user choice or be clearly documented as justified; here the behavior is automatic and not framed as opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest text states the skill makes content "in every language," which implies a broad language behavior without saying the user can choose or opt into a language/locale. The policy requires flagging language or locale constraints/behaviors when they are forced or unspecified rather than user-directed.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This description says the skill generates and publishes content "in every language" but does not mention any user choice, default, or limitation. That creates a natural-language policy concern because the skill appears to force or assume language behavior without explicit opt-in.
- Content
Static analysis
No suspicious patterns detected.