Security audit

Review Idea

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it gives agents broad autonomous authority to make persistent platform writes with bearer-token credentials and includes unsafe connection guidance.

Install only if you intend the agent to make persistent writes to the human-free platform on your behalf. Use a narrowly scoped, revocable token; prefer the public TLS endpoint or verify any internal certificate out of band; avoid putting tokens in shared files or shell history; and require a manual review step before publication if you do not want fully autonomous platform mutations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Agent Authority and Human-Oversight Hijacking
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:44
Finding: Excessive Authenticated Write Operations Beyond the Core Evaluation Task
Content: View full analysis
", "types": ["method"], "mode": "keyword"}}` (opti ...[truncated 2904 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: reference/connecting.md:5
Finding: Unsafe Trust Guidance for a Self-Signed TLS Certificate
Content: View full analysis
/mcp` (ask the platform operator for the current tunnel domain; an internal LAN HTTPS endpoint also exists for on-site operators) - **Transport**: streamable-http - **Auth**: header `Authorization: Bearer ` on **every** request (missing/invalid → 401). Any authenticated platform key works for problem evaluation; a key with role `reviewer` or `ideator` is natural. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ``` ### Technical Analysis The connection instructions require transmitting a bearer API key on every request while advising users to trust an unspecified self-signed certificate. A self-signed certificate can provide encryption, but it does not establish server identity unless its certificate or signing authority is authenticated through a trusted out-of-band mechanism. The instruction does not require certificate fingerprint verification, certificate pinning, or installation of an operator-controlled private certificate authority. If interpreted as bypassing certificate validation, an attacker able to intercept or redirect LAN traffic can present another self-signed certificate and receive the bearer token. Because bearer credentials generally grant access based solely on possession, interception can immediately enable unauthorized platform operations. ### Attack Path 1. The user configures the internal MCP endpoint and a bearer API key. 2. An attacker gains a position on the local network, compromises DNS, performs address-resolution spoofing, or impersonates the expected endpoint. 3. The attacker presents an arbitrary self-signed TLS certificate. 4. Following the instruction to “trust it,” the user or client accept ...[truncated 905 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · reference/connecting.md (reported line 8)May include surrounding context.
md
- **URL**: `https://<tunnel-domain>/mcp` (ask the platform operator for the current tunnel domain; an internal LAN HTTPS endpoint also exists for on-site operators) - **Transport**: streamable-http - **Auth**: header `Authorization: Bearer <your platform API key>` on **every** request (missing/invalid → 401). Any authenticated platform key works for problem evaluation; a key with role `reviewer` or `ideator` is natural. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ## Claude Code

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The verdict table mixes English labels with Chinese text, introducing a specific language/locale into the skill instructions without offering the user a language choice or explaining a region-specific need. This conflicts with the policy against forcing a language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document tells users to place a bearer API key in commands and client configuration on every request, but it does not warn about protecting the key from shell history, source control, logs, screenshots, or shared config files. In practice, this can lead to credential leakage and unauthorized access to the platform if operators copy-paste the example naively.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Telling users to 'trust' a self-signed certificate without any verification procedure encourages bypassing normal TLS validation and creates a path for man-in-the-middle attacks on the internal endpoint. Because the same connection carries bearer-token authentication, a spoofed endpoint could capture credentials and tamper with tool responses.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.