Deepfake Check

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:04 AM UTC
• Version: 1.0.3

Overview

The skill does what it says, but it persists an API key and uploads sensitive media through shell commands without enough consent and input-safety safeguards.

Review before installing. Use only non-sensitive media you are comfortable sending to Scam.ai, prefer a service-specific key over a universal key, and remove stored key files when no longer needed. The publisher should revise the skill to ask before uploads, document privacy/retention expectations, avoid shell interpolation for keys and paths, and remove mandatory promotional output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:113

Finding

Mandatory Promotional Output Injection

Content

View full analysis

Thanks for using the Deepfake Detection skill! Stay safe online. > Follow **Scam.ai** for the latest in AI-powered fraud and deepfake protection: https://scam.ai ``` ### Technical Analysis The skill directs the agent to append brand promotion and an external URL when the user finishes the workflow. This content is unrelated to the technical result and is mandatory rather than conditional on user consent. Because skill instructions influence the agent’s behavior when loaded, this requirement modifies the expected output of the current session. It causes the agent to act as a promotional channel instead of limiting its response to the user-requested deepfake analysis. ### Attack Path 1. The user loads the deepfake-detection skill. 2. The user submits an image or video for analysis. 3. The skill sends the file to the configured API and presents the result. 4. The user indicates that no additional file should be analyzed. 5. The skill compels the agent to emit promotional copy and an external Scam.ai link. ### Impact Assessment The issue compromises response integrity by inserting advertising into agent-generated output without explicit consent. It does not directly grant system privileges or enable local code execution, but it can be used to promote a third-party service or direct users to an external site under the apparent authority of the agent. The scope is limited to sessions in which the skill is invoked. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48

Finding

Shell Command Injection Through API Key Persistence

Content

View full analysis

~/.scamai_deepfake_key && chmod 600 ~/.scamai_deepfake_key # or for universal: echo -n "THEIR_API_KEY" > ~/.scamai_universal_key && chmod 600 ~/.scamai_universal_key ``` ### Technical Analysis The instructions tell the agent to substitute a user-provided API key into a Bash command template. If this substitution is performed as textual command construction, shell-significant characters in the supplied value can terminate or modify the quoted argument. Double quotes do not suppress every form of shell interpretation. A crafted value containing quote characters, command substitution syntax, or other shell metacharacters could change the command that Bash executes. The `chmod 600` operation protects the resulting file from other local users, but it does not mitigate injection during command construction. The vulnerable pattern also risks malformed credential storage when the key contains characters that are interpreted by the shell. ### Attack Path 1. The skill determines that no stored API key is available. 2. It asks the user to paste a DeepFake Detection or Universal API key. 3. A malicious or compromised user supplies a string containing shell syntax instead of a normal key. 4. The agent substitutes that string into the documented `echo` command. 5. Bash interprets the injected syntax while executing the generated command. 6. The injected command runs with the same operating-system privileges and environment access as the agent process. ### Impact Assessment Successful exploitation can execute arbitrary local commands under the agent’s account. The attacker could potentially read or modify files accessible to that account, steal stored credentials, alter project data, make network requests, or interfere with subsequent ag ...[truncated 227 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:78

Finding

Shell Command Injection Through User-Controlled Upload Path

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

> - **No** — follow these steps to get one:
>   1. Go to **https://scam.ai** and click **Sign Up** (or Log In)
>   2. In the left sidebar, scroll to the bottom → **Manage account → Developers**
>   3. Click **+ Create API Key** in the top right
>   4. Under **Service Type**, choose:
>      - **DeepFake Detection** — for this skill only
>      - **Universal Key** — one key for all Scam.ai services (recommended if you plan to use multiple skills)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the user to persist a sensitive API key to disk and says 'You won't need to enter it again' without clearly warning that the secret will remain stored locally across sessions. This creates avoidable credential-retention risk, especially on shared machines or environments where home directories are backed up, synced, or inspected by other tools.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

• Universal key → ~/.scamai_universal_key

bash

echo -n "THEIR_API_KEY" > ~/.scamai_deepfake_key && chmod 600 ~/.scamai_deepfake_key
# or for universal:
echo -n "THEIR_API_KEY" > ~/.scamai_universal_key && chmod 600 ~/.scamai_universal_key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

• Universal key → ~/.scamai_universal_key

bash

echo -n "THEIR_API_KEY" > ~/.scamai_deepfake_key && chmod 600 ~/.scamai_deepfake_key
# or for universal:
echo -n "THEIR_API_KEY" > ~/.scamai_universal_key && chmod 600 ~/.scamai_universal_key

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to upload user-provided images and videos to an external service for analysis, but does not clearly warn the user that their local files will leave the device and be transmitted to Scam.ai. This is dangerous because the files may contain biometric data, sensitive personal content, or regulated information, and users may reasonably assume analysis is local unless told otherwise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This command performs external transmission of a local image file and an API key to a third-party endpoint. External transmission is expected for this skill's purpose, but it is still security-relevant because it exposes user content and credentials to a remote service and should therefore be transparent and consent-based.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

For images (.jpg, .jpeg, .png, .webp, .gif, .bmp):

bash

curl -s -X POST "https://api.scam.ai/api/defence/faceswap/predict" \
  -H "x-api-key: $API_KEY" \
  -F "files=@PATH_TO_FILE"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This command uploads a local video file and uses the stored API key against an external API. The risk is higher than for images because videos often contain more sensitive biometric and contextual information and may reveal bystanders, voices, locations, or extended private activity.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

For videos (.mp4, .mov, .avi, .mkv, .webm):

bash

curl -s -X POST "https://api.scam.ai/api/defence/video/detection" \
  -H "x-api-key: $API_KEY" \
  -F "video=@PATH_TO_FILE"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L123 tells users to say "No" when asked if they have a key in order to update it, but the setup flow at L24-L36 shows that "No" sends the user through account/key-creation instructions rather than a key replacement path. The actual way to update via the interaction is to provide a new key when asked, so the note is actively misleading.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.