Security audit

Landing Experience Checker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent landing-page preflight helper, but it asks agents to write persistent shared memory despite declaring only state-read capability.

Review this skill before installing if your host trusts manifests for permissions. It appears intended for normal landing-page QA, but it should either declare a narrow state-write capability or require explicit approval before every write to shared memory files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:39
Finding: Persistent State Writes Exceed the Declared Capability Boundary
Content: View full analysis
.md` — see [Skill Contract](../../../references/skill-contract.md) §Save Results Template. ``` `distribution-manifest.json:2-5`: ```json "capabilities": [ "inline-delivery", "canonical-state-read" ], ``` ### Technical Analysis The distribution manifest declares `canonical-state-read` but does not declare a corresponding state-write capability. Nevertheless, the Skill contract directs the host agent to write results into persistent memory and to promote findings into shared files such as `memory/hot-cache.md` and `memory/open-loops.md`. The result-saving instruction at `SKILL.md:73` is conditioned on user confirmation, but the promotion instruction at `SKILL.md:40` contains no equivalent confirmation requirement. If the host relies on the manifest for least-privilege review but subsequently follows the Skill instructions without independently enforcing permissions, the Skill can perform state-changing operations beyond its declared capability ceiling. The data used to generate these persistent findings may originate from scraped landing pages, exported CSV files, or pasted advertisements. Although `SKILL.md:56` correctly states that such content must be treated as untrusted, persisting conclusions derived from attacke ...[truncated 1955 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.