Security audit

Fizzread

Security checks for vulnerabilities and agentic risk

Overview

This book-summary skill is useful and mostly purpose-aligned, but it handles API keys unsafely and requires unvalidated app download links in responses.

Review before installing. Use only a low-privilege FizzRead key, prefer environment configuration over pasting secrets into chat, and treat generated FizzRead download links as external links rather than verified destinations. The skill should be revised to check key presence without printing it, avoid shell interpolation of user-provided keys, and validate download URLs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:240
Finding: Mandatory Promotional Link Injection into Book Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:39
Finding: API Key Exposed Through Shell Diagnostic Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:65
Finding: Shell Command Injection Through Direct Interpolation of User-Provided API Keys
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
--- ## Output Rules 1. **Language**: Detect the user's conversation language. If not English, translate `about` content to the user's language. Keep book titles, author names, and audio labels in English.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly tells users to paste an API key into the conversation and then reuse it for subsequent requests, but provides no warning that chat messages may be logged, persisted, or visible to operators and other tooling. This creates an unnecessary secret-exposure path and can lead to credential leakage or later misuse of the user's API key.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.