Security audit

Call Report Writer Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but its name and description understate a much broader automated research, code-execution, scraping, visual-generation, and submission workflow.

Review this skill carefully before installing. It should be treated as a broad multimedia research/report-generation agent, not a narrow call report writer; only use it where web access, screenshot capture, Python execution, document creation, and automatic result submission are intended and appropriately permissioned.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata says it is a call report writer, but the embedded instructions redefine it into a broad autonomous research-and-publication agent with external URL investigation, screenshot capture, code-driven chart generation, and document submission. This capability mismatch is dangerous because users or orchestration layers may grant it permissions appropriate for a narrow reporting task while the skill actually attempts much wider data access and output actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions create an intent-level contradiction by labeling the skill as a call report writer while directing it to behave as a 'Multimedia Research Producer' producing media-rich investigative reports. This inconsistency increases the chance of deceptive tool enablement, policy bypass by misclassification, and operator misunderstanding about what the skill will actually do.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to perform networked research, scrape URLs, capture screenshots, and execute Python to generate assets, even though those capabilities are not clearly necessary for a call report writer. In practice, this broadens the attack surface for prompt injection, data exfiltration through external requests, and unsafe use of privileged tools under an innocuous-looking skill name.
Content: No source excerpt is available for this finding.