Creating Explainers

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:06 AM UTC
• Version: 1.0.2

Overview

This skill coherently creates interactive HTML explainers, with manageable cautions around Google Fonts and the local preview server.

Installers should expect this skill to read supplied source material, optionally use web research, and generate an HTML file with inline JavaScript. Preview the result from a dedicated output directory and prefer `python3 -m http.server 8000 --bind 127.0.0.1`; use an offline font option if contacting Google Fonts is not acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:141

Finding

Local Preview Server Binds to All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 141
Vulnerability Type: Network exposure caused by an insecure local testing command
Risk Level: Medium

Vulnerable Code Snippet

markdown

The "test it locally" step is `python3 -m http.server 8000` from the directory containing the file, then open it in a browser.

Technical Analysis

The recommended command starts Python's basic HTTP server on port 8000. Unless a bind address is specified, the server listens on all available network interfaces rather than only the loopback interface.

The server exposes the directory from which it is started, including its descendants. If the command is run from a directory containing unrelated artifacts, source documents, generated drafts, or sensitive files, those files may become remotely accessible to other systems capable of reaching port 8000.

The server itself does not grant operating-system privileges or allow arbitrary command execution. Exploitation requires network reachability while the temporary server is running, and the exposed scope is generally limited to files readable by the process beneath the selected serving directory.

Attack Path

1. The agent or user follows the documented preview procedure.
2. The command is run from the output directory, or accidentally from a broader directory containing additional files.
3. Python binds the HTTP server to all available network interfaces on port 8000.
4. An attacker on a reachable network discovers or already knows the host and port.
5. The attacker requests known file paths or browses directory listings.
6. The server returns files located within the exposed directory tree until it is terminated.

Impact Assessment

A reachable attacker could read files served beneath the selected directory with the permissions of the HTTP-server process. Potentially exposed content includes generated explainers, source materials copied into the directory, drafts, and other inadvertently ...[truncated 271 chars]

Remediation

View remediation

Remediation Suggestions

Bind the preview server explicitly to the loopback interface:

bash

python3 -m http.server 8000 --bind 127.0.0.1

Apply the following additional hardening measures:

1. Run the command only from a dedicated output directory containing the generated index.html and no unrelated files.
2. Verify the working directory before starting the server, for example with pwd and find . -maxdepth 2 -type f.
3. Stop the server immediately after testing.
4. Do not disable host firewall protections or expose port 8000 through containers, virtual machines, tunnels, or router forwarding.
5. Update the documented instruction to state that the server is for loopback-only development use.
6. When serving is unnecessary, open the self-contained HTML file directly in the browser instead.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description lists trigger phrases such as "make an explainer" and especially "explain X visually," which are broad natural-language requests that could match many ordinary user prompts. Although some scope is provided, the file does not give negative examples or tighter constraints for when this skill should not activate beyond the codebase exclusion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown states that the generated explainer may make external network requests to Google Fonts, which has privacy and network-behavior implications. However, the skill does not clearly warn users that opening the output can contact a third party or suggest an offline/privacy-preserving alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction requires a fixed writing voice: conversational, second-person, and analogy-rich. This is a natural-language policy concern because it imposes a specific linguistic style on outputs without indicating that the user can choose a different tone or locale-sensitive style.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file states "Never use em-dashes" as an absolute rule. This is a language-style constraint embedded in natural-language instructions without user opt-in or documented justification, which can conflict with organizational language-choice policies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The HTML root element sets lang="en", which forces the document language to English. This is a natural-language locale constraint with no visible user opt-in or indication that the template is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 7% confidence

Finding

I reviewed the file against the applicable categories for a markdown file. There are no credible language or locale policy violations, no missing safety warnings, and no vague trigger/invocation language because this is a reference document rather than a skill activation description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.