B2c Marketing 1.0.1

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:18 PM UTC
• Version: 1.0.0

Overview

This marketing skill is mostly coherent, but it asks for live social-posting credentials and persistent local scheduling without enough safeguards.

Review before installing. Use a dedicated, revocable Post Bridge key kept in a secure secret store rather than a general workspace .env when possible, confirm every public post or scheduled post before execution, and avoid allowing the skill to create cron entries unless the task is one-shot, explicitly approved, and automatically cleaned up.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:134

Finding

Unbounded Persistent Cron Task for Post-Status Monitoring

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 134
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code Snippet

markdown

5. Set cron to check post status 5 mins after scheduled time

Technical Analysis

The skill directs the agent to create a cron task as part of its daily workflow. A cron entry is persistent operating-system state that can survive the initiating process and agent session.

The instruction does not specify:

• The exact command or executable to be invoked
• The scope and lifetime of the scheduled task
• Automatic removal after the status check
• Duplicate-entry prevention
• Restrictions on inherited credentials or environment variables
• Explicit user approval before modifying the user's crontab

Because the scheduled command is unspecified, an implementing agent may construct a persistent task from contextual or externally influenced values. The task could continue executing after the original marketing operation has ended. No privilege-escalation mechanism is shown; execution would normally occur with the privileges of the user whose crontab is modified.

Attack Path

1. The agent loads the skill and follows the documented daily workflow.
2. A post is scheduled through the declared Post Bridge workflow.
3. The agent interprets line 134 as authorization to modify the local user's crontab.
4. It creates a cron entry that invokes an unspecified post-status checking command.
5. The entry remains installed after the current agent task or session ends.
6. Cron subsequently executes the command under the affected user's account.
7. Without one-shot cleanup or duplicate prevention, the command may continue running or additional entries may accumulate.

The project does not contain a concrete malicious cron payload, so exploitation depends on how the agent implements the underspecified instruction. The confirmed issue is the explicit direction to establish persistent scheduled execut ...[truncated 944 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to modify cron and perform the status check within the active agent workflow.
2. Prefer Post Bridge status APIs, platform callbacks, or an application-owned task queue with explicit lifecycle management.
3. If delayed local execution is essential, require explicit user confirmation before creating any scheduled task.
4. Use a narrowly scoped one-shot scheduler rather than a recurring cron entry.
5. Define the exact executable, arguments, working directory, and expected network destination; do not construct commands from untrusted captions, filenames, post metadata, or API responses.
6. Automatically delete the scheduled task immediately after successful execution or after a defined timeout.
7. Add idempotency and duplicate-entry checks.
8. Run with the minimum required user privileges and a restricted environment.
9. Do not place API keys in command-line arguments or cron definitions. Load credentials from a permission-restricted secret store at execution time.
10. Record task creation and removal so the user can verify that no persistent entry remains.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The instruction to obtain a live API key and place it in the workspace creates a clear credential-handling pattern that can expose a production secret to other tools, prompts, logs, or accidental commits. Because the same skill also automates posting to connected social accounts, compromise of that key could enable unauthorized content uploads, scheduling, or account abuse across multiple platforms.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

### Setup
1. Create Post Bridge account at post-bridge.com ($9/mo, API add-on $14/mo)
2. Connect your social accounts (TikTok, Instagram, YouTube, Twitter, etc.)
3. Get API key from Settings → API
4. Store in workspace `.env`: `POST_BRIDGE_API_KEY=pb_live_xxxxx`

### Posting Flow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to store and use a live third-party API key and to connect multiple social accounts, but it does not warn about credential sensitivity, least-privilege handling, or the privacy and account-risk implications of sending content and account actions through an external service. In an agentic context, normalizing direct use of a production key in a workspace .env can lead to accidental exposure, misuse by other tools in the workspace, or unintended automated posting to linked social accounts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.