Influencer Discovery

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 19.0.0

Overview

The skill is mostly a normal influencer-discovery helper, but one support file contradicts its permission rule by telling the agent to save creator dossiers.

Review this skill before installing if you handle creator data. Use it only with public business contact paths, avoid guessed or private contact details, and require an explicit destination and separate approval before any report, dossier, cache entry, CSV, CRM import, or registry proposal is written.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/creator-dossier.md:84

Finding

Creator dossier may be persisted without explicit user authorization

Content

View full analysis

Vulnerability Details

File Location: references/creator-dossier.md:84
Vulnerability Type: Authorization bypass through conflicting persistence instructions
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## 6. Output and handoff

Save the dossier alongside the discovery file for the same topic. In the
handoff to `fit-scorer`, carry the handle, niche, audience signal, brand-safety
flags, and contact-path step so scoring and outreach start with the full read.

Technical Analysis

The instruction unconditionally directs the agent to save a creator dossier. This conflicts with the authorization boundary established in SKILL.md, which states that discovery results may be written only with separate, exact authorization and otherwise must be returned inline without writing anything.

A dossier can contain creator identifiers, public contact details, audience observations, partnership history, and brand-safety assessments. Although much of this information may originate from public sources, persisting the compiled profile remains a state-changing operation. The conflicting reference instruction could cause an agent following the dossier workflow to bypass the skill's intended consent requirement.

This is an insecure skill configuration rather than an operating-system privilege escalation. The flaw arises because security-sensitive write authorization is not consistently enforced across all instructions loaded by the skill.

Attack Path

1. A user requests influencer discovery or a detailed dossier for a named creator.
2. The agent follows SKILL.md, which directs it to use references/creator-dossier.md for a deep creator review.
3. The agent collects public profile information, contact paths, audience signals, partnership history, and brand-safety observations.
4. The agent reaches the unconditional save instruction at line 84.
5. Without obtaining the separate exact authorization ...[truncated 1010 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unconditional save instruction with an explicit authorization gate, for example:

   markdown

   Return the dossier inline by default. Save it only after obtaining separate,
   exact user authorization, and use only the path and write constraints defined
   in `SKILL.md`.
   

2. Make SKILL.md the single authoritative source for persistence policy. Reference that policy from supporting documents rather than restating write behavior independently.

3. Require the agent to identify the exact destination and data being persisted before requesting authorization.

4. Separate authorization for dossier saving from authorization for discovery-report saving, shortlist caching, and creator-registry proposals. Approval for one operation must not imply approval for another.

5. Add a pre-write validation step that defaults to inline-only delivery unless an explicit authorization record exists for the current operation.

6. Add consistency tests or linting that flag imperative write terms such as “save,” “write,” “cache,” or “persist” in reference files unless they include the required authorization condition.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template explicitly prompts collection of influencer contact details such as public email, agency/manager information, and preferred contact method, but provides no guidance on lawful basis, minimization, storage, retention, or sharing controls. In an influencer-discovery workflow, this can normalize unnecessary harvesting and downstream handling of personal data, creating privacy, compliance, and misuse risks even if the data is publicly visible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.