Security audit

Copyright

Security checks for vulnerabilities and agentic risk

Overview

This is a plain copyright guidance skill with no executable code, hidden data access, persistence, or privilege requests.

Review this skill as a legal-information assistant: it may help organize copyright, DMCA, fair use, and licensing questions, but users should verify jurisdiction-specific advice and consult a qualified attorney before sending formal notices, counter-notices, settlement demands, or relying on fair use in high-stakes situations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The instruction "Run when any significant new work is completed" relies on the subjective term "significant" without explaining thresholds or exclusions. Different users or systems could interpret this inconsistently, causing the skill to activate too often or not often enough.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The invocation phrase "Help me check for unauthorized use of my work online" starts with a very broad everyday phrase ("Help me check") and does not define tighter activation constraints beyond the general topic. This can increase the chance of unintended invocation in normal conversation about online checking or review tasks.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list contains broad, common terms such as "copyright," "licensing," "fair use," and "infringement" that are likely to appear in ordinary conversations. This can cause the skill to activate in contexts where the user did not specifically intend to invoke it, increasing the chance of unnecessary scope expansion or over-application of legal guidance.

Vague Triggers

Low

Confidence: 80% confidence
Finding: The heading/value pair "Licensing inquiry" is broad and could match many ordinary discussions about licensing, while the file does not provide exclusion conditions or a bounded trigger list for similar requests. This creates some ambiguity about when this skill should activate instead of other legal or business-oriented skills.

Static analysis

No suspicious patterns detected.