Why this verdict
- suspicious: finding skill:skills/performing-ai-driven-osint-correlation:skills/performing-ai-driven-osint-correlation/references/api-reference.md:168:MANIP
- suspicious: finding skill:skills/performing-ai-driven-osint-correlation:skills/performing-ai-driven-osint-correlation/references/api-reference.md:7:EXEC
Security findings 2
Code execution
highContextual riskmedium confidenceThe artifact's api-reference.md instructs the agent to execute 'python agent.py' with correlation flags while no agent.py under this skill was served for review, so the code the agent would actually run is unreviewable.
python agent.py --target
vector:instruction
Counter-argument considered
Case against: the correlation CLI is the skill's declared purpose and the flags match Sherlock/theHarvester/SpiderFoot, and the missing script could argue the command is inert. Case for: the follow-up resolved the request NOT SERVED with matches only in other skills, so this skill ships no agent.py, yet its reference doc still tells the agent to run `python agent.py`; the instruction makes the agent execute whatever file sits at that path at runtime, which no carve-out covers and nothing declares, so the contextual_risk finding survives unrefuted.
Manipulation
mediumContextual riskmedium confidenceThe skill's references section mislabels the LOLBAS catalog (a repository of living-off-the-land Windows binaries used for execution and defense evasion) as a 'graph visualization' resource, which could steer the agent to consult offensive-technique material unrelated to the declared OSINT correlation purpose under a false, benign label.
LOLBAS for graph visualization: https://lolbas-project.github.io/
vector:instruction
Counter-argument considered
LOLBAS (lolbas-project.github.io) catalogs living-off-the-land binary abuse techniques and has no graph-visualization content, so the reference genuinely steers the agent to offensive-technique material under a benign, purpose-mismatched label inconsistent with the declared OSINT-correlation description; no carve-out or mitigation in the shown artifact neutralizes this deception.
Open questions 1
What the analysis could not settle from the code alone.
Residue/claim mismatch: the References section labels LOLBAS (https://lolbas-project.github.io/, a catalog of attacker-abusable living-off-the-land binaries) as 'LOLBAS for graph visualization', which matches no declared capability (graph visualization is declared via Maltego) and is factually wrong; intent (documentation error vs. nudging the agent toward attack-technique material) cannot be settled from the evidence shown.
Refuted findings 3
Candidates the review stage examined and rejected, kept for transparency.
Data exfiltration
criticalRefutedlow confidenceSKILL.md Phase 1 instructs the agent to send a target email address to the external haveibeenpwned.com breach API using an HIBP key read from the environment.
https://haveibeenpwned.com/api/v3/breachedaccount/target@example.com
Why it was refuted
Querying HIBP with the investigation target's email is the skill's declared core capability — the declared description lists 'breach databases' and the step itself is titled 'Query breach databases for email exposure (example with HIBP API)' — and HIBP_KEY is transmitted only to the service it authenticates, so the declared-capability and env-key-for-the-wrapped-service carve-outs apply.
Data exfiltration
criticalRefutedmedium confidenceSKILL.md Phase 3 instructs the agent to write and run correlate.py, which embeds up to 500 normalized OSINT findings into a prompt sent to the external OpenAI chat API using OPENAI_API_KEY read from the environment.
{json.dumps(findings[:500], indent=2)}Why it was refuted
Sending normalized findings to an LLM for correlation is the artifact's declared core capability ('Use AI/LLM-based reasoning ... to correlate OSINT findings' per the declared description) and OPENAI_API_KEY is the key of the very service called via the official client, so the data egress is the declared workflow rather than a concealed exfiltration channel.
Code execution
highRefutedlow confidenceThe api-reference.md References section points the agent to the LOLBAS living-off-the-land binary abuse repository under the false label of a graph-visualization resource, a mismatch with the skill's declared OSINT-correlation purpose.
LOLBAS for graph visualization: https://lolbas-project.github.io/
Why it was refuted
The cited line is a bare documentation hyperlink containing no command, script, download, or execution directive, so no EXEC behavior and no source-to-sink chain into any execution sink exists; the only defect present — the false label — is the separate MANIP concern, not an execution harm.
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:45bf5ed15b4f8426
invalid_judge_finding behavior-chains.0
