Security audit

Avbuzz

Security checks for vulnerabilities and agentic risk

Overview

The basic FANZA query skill is disclosed, but the optional bot setup asks users to run mutable external code persistently, including as root with messaging tokens.

Use the on-demand curl examples only if you are comfortable querying an unofficial adult-content FANZA endpoint. Treat the Discord/Telegram bot section as a separate unreviewed application: do not run it as root, do not enable a systemd service without a dedicated locked-down user, avoid putting tokens in command URLs or committed config files, and pin/review the cloned code and dependencies before starting it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:352
Finding: Root-Level Persistent Execution Through a System-Wide Service
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:280
Finding: Unpinned Remote Application and Dependency Retrieval Followed by Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.
md
1. Create app at [discord.com/developers](https://discord.com/developers/applications) → **Bot** tab → **Add Bot** → copy Token 2. **OAuth2** → **URL Generator** → scopes: `bot` → permissions: `Send Messages`, `Embed Links` → invite bot 3. Right-click server → **Copy Server ID** (enable Developer Mode first) 4. Right-click channel → **Copy Channel ID** ### Telegram Setup (Optional)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: avbuzz description: Query AV new releases, rankings, and actress info from FANZA GraphQL API. No authentication required. Supports direct curl queries and optional Discord/Telegram bot deployment. version: 1.1.0 user-invocable: true metadata:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
## API Overview **Endpoint:** `POST https://api.video.dmm.co.jp/graphql` **Authentication:** None (public API)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
Search by actress name, title, video code, or any keyword:

bash
curl -s -X POST https://api.video.dmm.co.jp/graphql \ -H "Content-Type: application/json" \ -d '{"query":"{ legacySearchPPV(limit: 10, offset: 0, sort: SALES_RANK_SCORE, floor: AV, queryWord: \"蒼井空\") { result { contents { id title deliveryStartAt contentType maker { name } actresses { id name } packageImage { largeUrl } review { average count } bookmarkCount } pageInfo { totalCount } } } }"}'

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as a simple unauthenticated query tool, but it also includes instructions for deploying a persistent Discord/Telegram bot with scheduled notifications and tracking. That expands the trust boundary from on-demand local API calls to long-running external integrations that can continuously transmit content and metadata, which is materially different from the stated scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation says the skill only supports on-demand queries and cannot autonomously push notifications, then immediately directs users to deploy a bot that performs scheduled digests and alerts. This contradiction can mislead reviewers and users about autonomy, persistence, and external transmission behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell users to place Discord and Telegram bot tokens directly into a local config file without emphasizing credential sensitivity, storage hygiene, or access controls. Exposed bot tokens can allow unauthorized control of messaging integrations, message exfiltration, impersonation, or spam from the victim's accounts.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The Telegram setup instructs users to place a bot token directly into a URL when calling getUpdates. Tokens embedded in shell history, browser history, logs, screenshots, or shared terminals are easily leaked and can grant full bot control to an attacker.
Content: Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
md
### Telegram Setup (Optional) 1. Message `@BotFather` on Telegram → `/newbot` → copy Token 2. Send a message, then visit `https://api.telegram.org/bot<TOKEN>/getUpdates` → find `chat.id` 3. Leave both fields empty to run Discord-only ### Discord Slash Commands

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: VPS and systemd deployment steps introduce remote administration and persistent-service behavior that are unnecessary for a local query skill. This can normalize running a long-lived networked process as root on a server, increasing operational and security risk beyond the skill's advertised purpose.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The systemctl enable guidance explicitly configures the service to persist and auto-start, turning a simple skill-adjacent utility into a long-running background process. Persistence increases exposure to secret leakage, unintended ongoing external communication, and abuse if the deployed bot or host is compromised.
Content: Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.
text
```bash systemctl daemon-reload && systemctl enable avbuzz && systemctl start avbuzz journalctl -u avbuzz -f # View logs

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest requests both shell execution and the curl binary for a skill whose stated purpose is simple querying of a public GraphQL API. Granting exec enables arbitrary command execution beyond the minimum needed for the advertised functionality, which increases the blast radius if the skill content, parameters, or downstream prompts are manipulated into constructing unsafe shell commands.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.