Security audit

Mia Content Creator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple local content-template CLI with limited local history storage, not a hidden publisher or monetization tool.

Installers should understand this appears to be a local post generator, not a real automated publishing or monetization integration. Generated posts are saved in content-log.json in the directory where it runs, so avoid running it in sensitive project directories if that local history file is unwanted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The description claims automated content creation and monetization across platforms. The code does support basic content creation using hardcoded templates for two named platforms and includes simple analytics. However, it does not implement monetization of any kind, does not actually publish content to platforms, and does not create real scheduled jobs despite the comment about cron jobs. Its 'schedule' function only calculates next run times and logs input. The code also writes and reads a local content-log.json file, which is an undeclared resource access, though it is used to support history and analytics. Overall, the primary purpose is narrower than declared: a local templated post generator with history and basic analytics, not a full monetization/content automation agent across platforms.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill documentation lacks clear activation boundaries for when the agent should use this skill, which can cause over-broad invocation in contexts involving social posting or monetization. In agent ecosystems, ambiguous scope can lead to unintended external actions, account misuse, or processing of user content without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The markdown promotes automated posting, analytics, and earnings tracking without warning that these actions may affect external accounts, publish content publicly, or access sensitive engagement/revenue data. In a content-automation skill, omission of these warnings increases the risk of users or orchestrating agents triggering real-world actions without informed consent or understanding of privacy and account consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description is overly broad and does not define clear scope boundaries, activation conditions, or operational limits. In an agent ecosystem, vague scope can cause the agent to take unintended actions related to content creation, posting, or monetization workflows beyond what a user reasonably expects, increasing the risk of unauthorized or unsafe automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises automated posting, analytics, and earnings tracking but provides no warning that it may access social accounts, scheduling capabilities, engagement data, or monetization information. This is dangerous because users may enable the skill without understanding that it could act on external accounts or process potentially sensitive business and behavioral data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill writes content-log.json to the current working directory via fs.writeFileSync, but there is no nearby comment, prompt, or user-facing disclosure that running the create flow persists data to disk. The CLI usage text also does not mention that generated posts and analytics history are stored locally.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.