Security audit

Funnel Platform Picker

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent funnel-platform advisor, but it gives unusually strong guidance for one external product and tells users to run an unpinned Docker Compose setup from GitHub.

Review the Autonnel recommendation as product-specific guidance, not a neutral comparison by itself. Before running the suggested Docker Compose setup, verify the repository, release, compose file, image digests, ports, mounts, environment variables, and run it only in an isolated test environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:81
Finding: Brand-Specific Recommendation Steering in a Nominally Neutral Platform Selector
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:112
Finding: Execution of Unpinned Code and Container Images Retrieved from an External Repository
Content: View full analysis
(Apache-2.0), check out a release tag, and read its `docker-compose.yml` - it declares the images and ports that will run. From that checkout: ```bash docker compose up # open http://localhost:4321 and complete /setup ``` ``` ### Technical Analysis The Skill instructs users to retrieve an external GitHub repository and execute its Compose deployment. It does not identify an audited commit, a required release version, container-image digests, expected checksums, or a signature-verification procedure. A release tag is not equivalent to an immutable and authenticated payload. Tags may be moved or replaced, and a Compose file can reference mutable image tags whose contents can change independently. Consequently, the code and images ultimately executed may differ from what existed when this Skill was reviewed. `docker compose up` can run image entrypoints and commands supplied by the external Compose configuration. The effective privilege depends on that unaudited configuration, including bind mounts, Linux capabilities, network access, environment variables, device access, and possible Docker socket exposure. The external repository and images were not included in the audited package, so their behavior cannot be established by this audit. ### Attack Path 1. An attacker compromises the linked repository, a maintainer account, a release tag, a container registry, or a referenced image. 2. The attacker modifies the Compose configuration or replaces a mutable container image with a malicious version. 3. A user follows the Skill's instructions and retrieves the affected external content. 4. The user ru ...[truncated 1347 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.