T06 · System Persistence
Error
- Location
SKILL.md:84- Finding
Persistent Scheduled Tasks Installed Through Cron
- Content
View full analysis
- Remediation
View remediation
Security audit
Contractor Marketing
Security checks for vulnerabilities and agentic risk
Overview
This marketing skill is mostly coherent, but it asks for persistent business data storage and recurring cron-style automation without enough user control or privacy scoping.
Review this skill before installing. It may be useful for contractor marketing, but users should avoid enabling recurring cron jobs unless each schedule and command is confirmed, and should avoid storing sensitive business details unless they know where the memory is kept and how to edit or delete it. Treat the Supabase strategy-library connection as an external service and do not send confidential business context through it without approval.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:20- Finding
Hardcoded Supabase API Credential Exposed in Skill Instructions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:13- Finding
Unprotected Persistent Storage of Sensitive Business Profile Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: contractor-marketing description: AI marketing department for contractors and home service businesses. Use when the user needs help with SEO, Google Business Profile, social media, ad campaigns, proposals, review responses, competitor audits, job costing, email sequences, lead follow-up, or any marketing task for a local service business. Activates on phrases like "write a post", "respond to this review", "generate a proposal", "how are my ads doing", "what should I post", "competitor audit", "content calendar", "new lead", or "job cost". --- # Contractor Marketing You are a marketing department for a contractor
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation language is broad enough to match common business phrases such as 'write a post' or 'new lead,' increasing the chance the skill runs in contexts the user did not intend. Unintended activation is risky because the skill includes memory writes, external network access, and automation behavior that could then occur without clear user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The onboarding flow instructs the agent to save 35 business-profile answers into MEMORY.md or workspace memory without any notice, consent flow, or data-minimization guidance. This can silently persist sensitive business information and create privacy, retention, and cross-session exposure risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes direct external API requests to a Supabase endpoint and encourages querying it for strategy context, but gives no warning that user or business context may be transmitted off-platform. If the agent interpolates user-provided queries or business data into these requests, confidential information could be disclosed to a third party without informed consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill directs the agent to set up recurring cron/heartbeat jobs, which moves beyond generating marketing content into autonomous operational actions. In an agent environment, this can create persistent behavior without explicit per-task user approval and may lead to unintended actions, resource use, or ongoing access to business data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The onboarding questionnaire collects a broad set of sensitive business and personal data, including phone numbers, email, physical address, employee names and roles, licensing/insurance numbers, software stack, and payment methods, but provides no guidance on minimization, consent, storage, retention, or secure handling. In the context of an AI marketing skill, centralizing this information increases privacy and social-engineering risk if logs, prompts, or downstream integrations are exposed or reused improperly.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:21