App Legal Pages

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:46 AM UTC
• Version: 0.1.6

Overview

The skill mostly does what it claims, but its production-ready examples can publish the wrong contact email and legal jurisdiction if copied unchanged.

Install only if you will replace all sample contact and jurisdiction values, review the generated legal pages line by line, and confirm the exact Cloudflare project before deployment. Do not paste Cloudflare API tokens into prompts; configure credentials in the environment or use Wrangler login.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56

Finding

Hardcoded Personal Contact Address Can Redirect Privacy Requests

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:56-57; duplicated in assets/example-output/privacy.html:37,49 and assets/example-output/terms.html:38
Vulnerability Type: Hardcoded sensitive contact information and unintended data routing
Risk Level: Medium

Vulnerable Code

bash

--base-email "[e-mail]" \
--email-tag "quillnest" \

The resulting address is embedded in the example legal pages:

html

<p>You may request access, correction, or deletion of your information by contacting <a href="mailto:[e-mail]">[e-mail]</a>.</p>

html

<p>Email: <a href="mailto:[e-mail]">[e-mail]</a></p>

Technical Analysis

The primary generation example supplies a real-looking personal email address rather than a reserved example address. The generator derives [e-mail] from this value, and the same address is already embedded in the distributable example output.

Users or automated agents may treat the documented command and example assets as deployment-ready. If copied without modification, the generated Privacy Policy and Terms direct access, correction, deletion, support, and other legally significant requests to that mailbox. Because privacy requests commonly contain identifying information, account details, and descriptions of personal data, this creates an unintended sensitive-data disclosure channel.

No mailbox credentials or local system privileges are exposed by the code itself. The vulnerability concerns unauthorized receipt of communications and personal information from visitors to incorrectly configured deployments.

Attack Path

1. A publisher follows the canonical command in SKILL.md or copies files from assets/example-output.
2. The publisher fails to replace the hardcoded base email before deploying the legal site.
3. The published ...[truncated 1245 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the personal address in SKILL.md with a reserved neutral value such as [e-mail].
2. Remove the address from all files under assets/example-output and regenerate those assets with clearly fictional contact information.
3. Require the publisher to provide --email or --base-email explicitly rather than supplying a copyable personal default.
4. Before deployment, validate generated pages and reject known sample addresses, example.com addresses, placeholder markers, or contact values not explicitly approved by the publisher.
5. Include the final contact address in the mandatory review summary and require explicit confirmation that it belongs to the deploying entity.
6. Add automated tests that scan documentation and example assets for personal email addresses and prevent publication when one is detected.
7. Regenerate the stale example pages to remove TODO_LEGAL_REVIEW, unsupported sharing and international-transfer language, and the hardcoded China governing-law clause so examples cannot be mistaken for reviewed production output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code clearly supports part of the declared description: it generates Privacy Policy and Terms of Service static website files from an app feature document. However, the declared purpose significantly overstates the implementation. There is no code for GitHub interaction, Cloudflare Pages deployment, authentication, network access, repository creation/updates, or publication of URLs. There is also no consistency-checking logic beyond simple keyword heuristics, and no deployment-ready orchestration beyond writing local HTML/CSS files. Therefore the description does not accurately represent the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, reads/writes files, and checks environment-based Cloudflare authentication, but it declares no explicit tool scope or permissions boundary. That increases the chance an agent can perform filesystem or deployment actions without a clearly constrained authorization model, especially in a skill that can publish content publicly.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The workflow includes automatic deployment after confirmation, meaning the skill can take an external side effect—publishing content to Cloudflare Pages—without a separate execution boundary beyond conversational approval. In a skill that produces legal content, this raises risk of accidental public release of incorrect or incomplete documents if confirmations are ambiguous or if prior steps were wrong.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

4. Present generated pages for user review/approval.
5. Check Cloudflare deployment auth readiness.
6. Ask user to complete auth if missing.
7. Auto-deploy to Cloudflare Pages after explicit confirmation.
8. Return final public URLs.

## 1) Collect Inputs

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill says it must not assume analytics, tracking, sharing, or permission usage unless explicitly stated, but later instructs use of heuristic auto-detection from feature text. That contradiction can generate inaccurate privacy disclosures, leading to false legal statements or omitted disclosures in public policies, which is especially risky for a legal-document generation skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The language rule states that the skill should generate English-only legal pages by default and exclude non-English feature bullets to keep language consistent. This is a locale/language restriction expressed in natural language, and the file does not offer the user an explicit language choice or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill handles Cloudflare authentication and public deployment but does not clearly warn that API tokens are sensitive secrets or that publishing makes the legal pages publicly accessible. In a deployment-oriented skill, that omission can lead users to expose credentials in insecure contexts or unintentionally publish inaccurate legal content.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The dedicated 'Auto-Deploy to Cloudflare Pages' section operationalizes autonomous publication once auth is ready, increasing the likelihood of external side effects from a skill execution. Because the content is intended for production legal pages, accidental or premature deployment can create public legal, reputational, and operational exposure.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

wrangler login

text

## 7) Auto-Deploy to Cloudflare Pages

After explicit approval + auth ready:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The terms page hard-codes 'the laws of China' as the governing law without clarifying territorial scope, user location applicability, or whether this is merely example placeholder text. In a skill that generates production-ready legal pages, this can cause deployers to publish legally inaccurate terms, creating enforceability problems, regulatory mismatch, and potential business or consumer disputes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/deploy_cloudflare_pages.py (reported line 11)May include surrounding context.

python

def run(cmd, cwd=None, check=True):
    p = subprocess.run(cmd, cwd=cwd, text=True, capture_output=True)
    if check and p.returncode != 0:
        raise RuntimeError(f"Command failed: {' '.join(cmd)}\n{p.stderr.strip()}")
    return p

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 15)May include surrounding context.

python

def run(cmd):
    p = subprocess.run(cmd, text=True, capture_output=True)
    if p.returncode != 0:
        raise RuntimeError((p.stdout or "") + "\n" + (p.stderr or ""))
    return p.stdout.strip()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language content in the Feature Context states "Primary Language: English (U.S.)" as a default recommendation. This can conflict with organizational language/locale policy when the skill appears to mandate a specific locale without offering user choice or documenting a justified regional restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code accepts a direct email address or derives one from a base email and then injects it into generated public-facing HTML documents. While the script logs output filenames, it does not clearly warn the user that the supplied email will be published in the generated site content, and there is no inline comment or docstring disclosing that privacy impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.