Report Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 19.0.0

Overview

The skill is a legitimate report generator, but it asks agents to persist business-sensitive reports and conclusions despite a read-only-style capability manifest.

Review before installing in environments with writable memory. It may retain campaign financials, creator performance data, client/customer metrics, and model-derived renew/drop judgments across sessions; use it only where persistent report storage and hot-cache updates are intended and controlled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:24

Finding

Persistent State Writes Exceed Declared Skill Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-25 and SKILL.md:77; capability declaration in distribution-manifest.json:2-6
Vulnerability Type: Capability declaration mismatch and unauthorized persistent-state modification
Risk Level: Medium

Evidence

SKILL.md:24-25:

markdown

- **Writes**: a finished report in the audience-appropriate template, saved to `memory/influencer/report-generator/YYYY-MM-DD-<topic>.md`.
- **Promotes**: durable verdicts (final ROI/ROAS, top performers, renew/drop calls, headline learnings) to `memory/hot-cache.md`.

SKILL.md:77:

markdown

5. **Save and promote** — write the finished report to `memory/influencer/report-generator/YYYY-MM-DD-<topic>.md` (paid runs to `memory/ad/report-generator/`). Promote durable verdicts (final ROI/ROAS, top performers, renew/drop calls, headline learnings) to `memory/hot-cache.md`.

distribution-manifest.json:2-6:

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

Technical Analysis

The manifest declares only inline delivery and canonical-state reading, while the skill instructions explicitly require writing reports and derived judgments to persistent memory. This creates a least-privilege and capability-transparency mismatch: a host or reviewer evaluating the package from its manifest would not expect the skill to modify persistent state.

The report inputs can include campaign spend, revenue, customer counts, creator performance, and other business-sensitive information. The skill also directs the agent to promote generated judgments into the shared memory/hot-cache.md state. If the runtime follows these instructions and provides write-capable tools despite the manifest, user-controlled inputs and model-derived conclusions can persist beyond the current task and become available to later workflows.

This is not evidence of exec ...[truncated 1770 chars]

Remediation

View remediation

Remediation Suggestions

1. Update the distribution manifest to declare a narrowly scoped persistent-state write capability if writing reports is required for normal operation.
2. If the lite profile does not permit state writes, remove the mandatory save-and-promote instructions and return reports through inline delivery only.
3. Require explicit user consent before persisting campaign data, especially financial, customer, creator, or client information.
4. Make hot-cache promotion opt-in rather than automatic, and restrict it to a validated allowlist of non-sensitive fields.
5. Isolate stored reports by tenant, user, and campaign to prevent unrelated sessions from reading or modifying them.
6. Sanitize user-controlled campaign names before using them in paths, enforce a fixed base directory, and reject traversal sequences or unexpected path separators.
7. Define retention and deletion controls for generated reports and cached verdicts.
8. Add automated validation ensuring that documented reads and writes do not exceed the capabilities declared in distribution-manifest.json.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly writes finished reports to persistent memory paths and promotes summary verdicts into a shared hot-cache, but the skill description and operational guidance do not surface a clear user-facing warning or consent step before modifying persistent state. This creates a real risk of unintended data retention, propagation of incorrect or sensitive business conclusions, and cross-task contamination if later workflows trust the cached verdicts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.