HiMarketInsight

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 0.1.0

Overview

This market-research skill is mostly coherent, but it asks for broad shell and file-editing power that is not clearly needed or controlled for its stated purpose.

Review this skill carefully before installing. It appears designed for legitimate market and strategy work, but only install it in an environment where shell execution and file writes are disabled or tightly sandboxed unless you explicitly trust the publisher and need those powers for report generation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Shell and Filesystem Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4-11
Vulnerability Type: Excessive tool authorization
Risk Level: Medium

The Skill declares the following tool permissions:

yaml

allowed-tools:
  - read_file
  - search_content
  - web_search
  - web_fetch
  - execute_command
  - write_to_file
  - replace_in_file

Technical Analysis

The documented purpose of this Skill is market research, competitive analysis, and strategic report generation. Its workflows require information retrieval and analysis, but they do not document a legitimate need to execute arbitrary operating-system commands or modify local files.

Authorizing execute_command, write_to_file, and replace_in_file therefore expands the agent's authority beyond the stated task requirements. This violates the principle of least privilege. The combination is particularly sensitive because it permits both arbitrary command execution and modification of files accessible to the agent runtime.

No instruction in the audited file directly invokes these tools maliciously, and no embedded payload was found. Exploitation would require the agent to act on malicious user input, prompt-injection content retrieved during web research, or another untrusted instruction source.

Attack Path

1. An attacker places adversarial instructions in user-supplied material or online content likely to be retrieved during market research.
2. The Skill uses web_search, web_fetch, or read_file to ingest that untrusted content.
3. If the agent treats embedded instructions as authoritative rather than as data, the content directs it to invoke execute_command, write_to_file, or replace_in_file.
4. The unnecessarily authorized tool is used to run a local command or modify an accessible file.
5. The resulting action occurs with the permissions of the agent runtime.

This is a conditional exploitation path: the audited Skill grants the ...[truncated 804 chars]

Remediation

View remediation

Remediation Suggestions

Apply least-privilege controls to the Skill:

1. Remove execute_command, write_to_file, and replace_in_file because none is required by the documented research workflows.
2. Retain only the minimum necessary tools, such as web_search, web_fetch, and search_content.
3. Permit read_file only when analysis of user-provided documents is required, and restrict it to an approved workspace or explicit allowlist.
4. If report-file generation is a genuine requirement, replace unrestricted write access with a narrowly scoped export capability limited to a dedicated output directory, safe file types, and non-overwrite behavior.
5. If command execution must be introduced in the future, use an explicit command allowlist, disable shell interpretation, reject metacharacters, enforce argument-level validation, and run commands in a restricted sandbox with no secrets or network access.
6. Treat web pages and local documents as untrusted data. Add an explicit instruction that commands or agent directives found in retrieved content must never be followed.
7. Require user confirmation before any state-changing operation and log all filesystem or process actions for review.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level description is extremely broad and covers common business activities such as industry research, market analysis, competitive intelligence, strategy planning, and report writing. Overbroad activation increases the chance the skill is invoked in loosely related contexts, where it may gain access to powerful tools and external content unnecessarily, increasing exposure to prompt injection, sensitive data handling, and misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is for market research and strategic analysis, but it is granted execute_command, which is not justified by the stated functionality. In an agent setting, unnecessary shell execution materially expands the attack surface: prompt-influenced workflows, fetched web content, or user-supplied inputs could be transformed into command execution, leading to local file access, tool chaining, data exfiltration, or system compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list is broad and permissive, with many generic requests that overlap with ordinary business assistance. Because this skill also has web access, file modification tools, and shell execution, weak trigger constraints make accidental or attacker-induced activation more dangerous by routing unrelated tasks into a high-privilege skill context.

Content

No source excerpt is available for this finding.