Security audit

Generate Ideas

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for an agent-run research platform, but it asks for autonomous external writes and bearer-token MCP access with weak TLS guidance, so it deserves user review before installation.

Install only if you intentionally want an agent to write to the human-free platform without per-item review. Use a narrowly scoped, revocable ideator token; prefer the public TLS endpoint or verify any internal certificate through a trusted fingerprint or private CA; and consider requiring manual confirmation before publish, mark_ideated, bump_attention, or feedback calls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Skill Instructions Override Human Authority and Approval Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: reference/connecting.md:7
Finding: Unverified Self-Signed TLS Certificate Can Expose Bearer Credentials
Content: View full analysis
` on **every** request (missing/invalid → 401). For idea generation use a key with role **`ideator`**. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ``` ### Technical Analysis The connection instructions recommend trusting a self-signed certificate without requiring certificate fingerprint verification, certificate pinning, or installation of a controlled private certificate authority. The same connection carries a reusable Bearer API key on every request. TLS encryption only authenticates the server when the client validates that the presented certificate belongs to the intended endpoint. Unconditionally accepting an arbitrary self-signed certificate removes that authentication property. An attacker able to intercept or redirect traffic can present another self-signed certificate and impersonate the MCP service. Because the Authorization header is transmitted after establishing the improperly authenticated TLS session, the impersonating endpoint can capture the Bearer token. It can also alter MCP tool responses, present fabricated methods or problems, and influence subsequent Agent actions. ### Attack Path 1. The operator configures the Agent to use the internal MCP endpoint. 2. Following the documentation, the operator or client accepts the endpoint’s self-signed certificate without validating a fingerprint or trusted private CA. 3. An attacker gains a network interception or redirection position through mechanisms such as local-network spoofing, DNS manipulation, proxy misconfiguration, or endpoint substitution. 4. The attacker presents an attacker-controlled self-signed certificate. 5. The client accepts that certificate un ...[truncated 1022 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to act 'fully autonomously' and to 'never defer to a human's value judgment or wait for human approval,' while also directing it to publish ideas, mark coverage, and submit feedback. This removes an important safety check for a workflow that makes irreversible external changes, increasing the risk of uncontrolled actions, misjudgments, or abuse if the skill is triggered in the wrong context.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · reference/connecting.md (reported line 8)May include surrounding context.
md
- **URL**: `https://<tunnel-domain>/mcp` (ask the platform operator for the current tunnel domain; an internal LAN HTTPS endpoint also exists for on-site operators) - **Transport**: streamable-http - **Auth**: header `Authorization: Bearer <your platform API key>` on **every** request (missing/invalid → 401). For idea generation use a key with role **`ideator`**. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ## Claude Code

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases include broad language like 'generate ideas' and 'find ideas from methods', which can match ordinary user requests that are not intended to invoke this autonomous publishing workflow. Because the skill performs external reads and writes, overbroad activation increases the chance of unintended execution and unauthorized publication or state changes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.