Security audit

Content Calendar

Security checks for vulnerabilities and agentic risk

Overview

This content-calendar skill is purpose-aligned and does not show hidden code execution, network access, or deceptive behavior, though it stores content planning data persistently.

Before installing, understand that the skill keeps a local content-data.json with your channels, drafts, ideas, notes, schedule, and performance observations. Avoid putting sensitive or confidential campaign material into it unless you are comfortable with that data being retained locally, and consider adding your own process for reviewing or deleting the stored file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README presents multiple natural-language example phrases such as requests for content ideas, scheduling, drafting, repurposing, and calendar checks that are broad enough to overlap with ordinary user conversation. In a conversational agent, this can cause unintended or over-broad skill invocation, which may lead to the skill activating when the user did not explicitly intend to use it and influencing responses or workflows unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use the skill when anyone 'asks for help creating posts,' alongside broad references like 'content ideas.' These phrases overlap with common everyday requests and do not clearly bound when this skill should activate versus more general writing or planning skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly persists user data to content-data.json and instructs the agent to always read and write that file, but it gives no user-facing notice, consent flow, retention rule, or data minimization guidance. Because this skill stores drafts, notes, themes, and performance observations, it can accumulate sensitive business or personal content without the user understanding that the information is being retained across sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The input phrase "What's on the calendar this week?" is a natural, everyday question and the file does not provide any constraints, explicit trigger scope, or negative examples to distinguish when this skill should activate. In a markdown skill/eval context, that makes the activation condition potentially too broad and susceptible to unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction 'Never use em dashes' imposes a fixed stylistic/language constraint regardless of user preference. The policy allows such constraints when the user is offered a choice or the restriction is clearly justified, neither of which is present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.