Security audit

Agent Expression

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its meme-pack purpose, but it deserves review because it can modify multiple agent installations and can send local images or captions to external APIs using ambient credentials.

Install only if you are comfortable with a skill that links itself into multiple agent environments and may use external AI APIs for image captioning and embeddings. Prefer downloading and inspecting the installer instead of piping it directly to a shell, avoid custom install paths containing important files, keep private images out of API-backed ingest flows, and only set API keys/base URLs you trust.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises operational behavior that uses shell execution, file reads/writes, environment variables, and networked APIs, but it does not declare permissions or clearly surface these capabilities as explicit requirements. This increases the chance that a host agent or user will invoke the skill without understanding its access needs, leading to unintended filesystem changes, secret exposure via env usage, or external data transfer.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description emphasizes a local meme/sticker retrieval skill, but the documented behavior extends to repository installation/update flows, external vision and embedding API usage, and local index/database maintenance. That mismatch can mislead users and agents about the true trust boundary, causing them to permit network operations, code retrieval, and persistent local modifications they did not expect.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The tool accepts remote http(s) image sources even though the skill is described as a local meme/sticker pack utility, and those images are later processed by vision logic that can transmit image contents externally. This creates an unexpected data-flow from user-provided URLs into outbound network activity, increasing privacy and trust risks for a supposedly local tool.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The tool performs outbound HTTP requests to a configurable vision base URL using image data and API credentials, which exceeds the expected scope of a local sticker-pack helper. Because the endpoint is configurable, a compromised or untrusted configuration could redirect image contents and authentication material to an attacker-controlled service.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: If the chosen destination exists and is not a Git repo, the script recursively deletes it before cloning. Because the destination can be influenced via -Dir and environment-derived paths, a user can unintentionally destroy arbitrary local data, which is especially risky for an installer distributed as a one-liner.

Description-Behavior Mismatch

Medium

Confidence: 77% confidence
Finding: The script can fetch attacker-controlled remote content over HTTP(S) even though the skill is described as a local meme/sticker pack. This expands the trust boundary, enables outbound network access, and creates SSRF-style risk despite partial private-host checks; those checks are incomplete and can be bypassed via redirect handling or unclassified internal/special-purpose IP ranges.

Context-Inappropriate Capability

Medium

Confidence: 74% confidence
Finding: The network download capability is not justified by the stated local-only purpose, so it introduces unnecessary attack surface. In an agent context, any unneeded outbound fetch can be abused to retrieve untrusted content, contact unintended hosts, or violate user expectations about locality and data handling.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script accepts remote http(s) URLs as input and, in normal operation, converts the referenced image into a data URL that is sent to an external vision service. That behavior contradicts the skill's 'local meme/sticker pack' framing and creates an unexpected data egress path for user-supplied content, which can expose private images or enable retrieval of attacker-controlled remote content.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script loads API keys and endpoint configuration from environment variables and Hermes/home configuration in order to contact an external vision provider. In a skill presented as a local utility, this is a meaningful hidden expansion of capability because it enables outbound transmission using ambient credentials the user may not realize the skill can consume.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The classifier issues an outbound HTTP POST to a configurable base URL with the image embedded in the request body. Because the endpoint is configurable, the script can send image contents to arbitrary third-party services, increasing the risk of data leakage and making the local-skill context materially more dangerous.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script explicitly describes use of a remote Zhipu embedding service, which conflicts with the skill metadata claiming a local-only sticker pack. That mismatch can mislead users and operators about data flow and privacy boundaries, causing caption text from local content to be transmitted off-device without informed consent.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: At this call site, caption text is sent to an external embedding API via emb.embed_texts(texts, cfg=cfg). Even if the text seems low-risk, meme captions or user-provided image descriptions may contain sensitive or private content, and the skill description does not adequately disclose that remote exfiltration path.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The script requires an external API key for operation, which is inconsistent with the stated local sticker-pack purpose and indicates undeclared reliance on a third-party service. The issue is not the mere presence of credentials, but that credential-gated remote behavior is hidden behind a misleading local-only description, increasing privacy and supply-chain risk.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The script converts local image files into data URLs and sends them to a configurable external vision API for captioning. That is a real data exfiltration path for local content, and it materially exceeds the stated local-only sticker-pack behavior, especially if packs may contain private user images.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The code performs outbound HTTP requests to a user-configurable base URL with an Authorization header, enabling transmission of local image content and secrets to external infrastructure. In the context of a supposedly local sticker-pack skill, this broad network capability is dangerous because it breaks locality and can be redirected to untrusted endpoints.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code enumerates likely .env locations, reads the first one found, and then overlays the entire process environment into a returned dictionary. For a local meme indexer, this creates unnecessary access to potentially sensitive configuration and secrets, expanding the skill's data-access scope beyond what is needed for indexing/searching images.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The code sends meme captions, tags, and keywords to a third-party embedding API, which contradicts the skill's stated 'local' sticker-pack purpose and creates an undisclosed data egress path. Even if the content seems low sensitivity, captions or ingested user-provided text could contain private or proprietary information and will leave the local environment.

Context-Inappropriate Capability

High

Confidence: 92% confidence
Finding: The helper loads API credentials from environment-derived sources and is designed to perform outbound requests, which is not justified by the advertised local-only behavior. This expands the trust boundary, enables external service dependence, and may cause operators to expose secrets and permit egress they would otherwise forbid for a local media skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README recommends piping remote content directly into a shell or PowerShell interpreter (`curl | bash`, `irm ... | iex`). If the upstream repository, distribution channel, or network path is compromised, users can execute arbitrary code immediately with their local privileges. In a skill intended for local agent installation, this is especially relevant because users are explicitly instructed to run these commands as the primary installation method.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The instruction to copy files into a workspace directory when direct preview is denied causes an unannounced file write into user-controlled project space. In context, this can unexpectedly modify repositories, leak local media into tracked workspace files, or trigger downstream tooling that watches workspace changes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: At execution time, the tool can fetch a remote image and upload image content for classification/captioning without any immediate warning, confirmation, or consent mechanism. This makes unintentional exfiltration of user-supplied images more likely, especially in an agent context where tool calls may feel implicit.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The tool loads and uses a vision API configuration, including credentials, without surfacing that credential-backed external services are involved. While this is not direct credential leakage in this file, the hidden use of secrets reduces transparency and can cause users to unknowingly trigger paid or sensitive third-party processing.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script calls Remove-Item -Recurse -Force on an existing destination with no confirmation, backup, or prominent warning. In an installer context, that can cause irreversible local data loss if the target path is mistaken, manipulated, or unexpectedly resolved.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The examples recommend 'irm ... | iex', which executes network-fetched script content directly, and the installer then invokes external tools like git and cmd. This pattern removes review opportunities and increases supply-chain risk if the repository, transport path, or environment variables are compromised.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The installer unconditionally removes an existing non-git destination with `rm -rf` before cloning. Although the path is usually under the user's home directory, it can be redirected via environment variables or `--dir`, so a mistaken or unsafe path can destroy local data without an explicit confirmation prompt.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: hermes-tools/add_meme_tool.py:58

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: hermes-tools/search_meme_tool.py:65

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/add-meme.py:39

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/classify-and-add-meme.py:26

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/embed-memes.py:15

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/index-memes.py:25

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/meme_embed.py:58

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/pick-meme.py:19

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/search-meme.py:16