Security audit

Sop Writer

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly provides SOP templates, but it also ships a separate executable content-marketing helper that logs user input locally without clear disclosure.

Review this package before installing. The main SOP generator appears local and non-destructive, but the bundled script.sh helper has a different content-marketing purpose and records user input in a local history file. Avoid entering confidential process details into that helper unless you are comfortable with local persistence, and prefer the documented scripts/sop.sh path for SOP generation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose is an SOP authoring/workflow tool focused on SOPs, flowcharts, checklists, audits, templates, and training materials. However, the code implements a marketing/content writing helper with commands centered on drafts, headlines, SEO, publishing schedules, hooks, CTAs, repurposing, and engagement metrics. While both are loosely related to writing, the primary purpose is materially different. The local history logging is a minor implementation detail and not the reason for the mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script’s declared purpose and exposed commands implement a content-marketing assistant rather than an SOP-writing tool. This mismatch is dangerous because users may invoke the skill expecting SOP-generation behavior while their inputs are handled by unrelated functionality, undermining trust, causing misuse, and masking the true data-handling behavior of the tool.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file describes the skill's capabilities but does not define specific trigger phrases, activation conditions, or exclusion cases. Without explicit invocation constraints, the skill could be matched too broadly whenever a user discusses SOPs, flowcharts, checklists, audits, templates, or training materials.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents itself as an SOP writer in metadata/comments while the help output and command implementations clearly serve a different assistant role. In a skill ecosystem, this kind of identity inconsistency increases the risk of deceptive packaging, accidental overtrust, and unsafe handling of user content because operators cannot accurately assess what the skill actually does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: User-supplied input is appended to a persistent history file without any notice, consent, retention policy, or sensitivity controls. This is risky because users may provide proprietary SOP content, internal process details, or other sensitive text that remains stored on disk and could later be exposed through local compromise, backups, or multi-user access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This shell skill presents its title, command descriptions, and many generated document sections in Chinese or bilingual Chinese by default. Because the file does not offer any user opt-in or locale selection, it imposes a specific language/locale on all users, which matches the policy-violation category for language constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The description and headings present bilingual content, but the file does not state whether the skill adapts to the user's preferred language or requires explicit opt-in. This can create a language-policy issue if the skill defaults to a language or mixed locale presentation without user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.