Email Marketer

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:07 AM UTC
• Version: 2.0.0

Overview

This skill is a disclosed local email-marketing note tracker with privacy and export hardening gaps, but no evidence of hidden access, exfiltration, or destructive behavior.

Install only if you are comfortable with campaign notes being stored in plaintext under your local home directory and later exportable. Avoid entering customer personal data, credentials, mailing-list contents, or confidential strategy unless file permissions and retention are handled outside the skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:6

Finding

Marketing Records Are Created Without Restrictive Access Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 6–9; record and export files are subsequently created under this directory
Vulnerability Type: Insecure local storage permissions
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${HOME}/.local/share/email-marketer"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Technical Analysis

The script creates its data directory and log files without first setting a restrictive process umask and without explicitly assigning secure permissions. Consequently, permissions are inherited from the invoking environment.

Under a common 022 umask, the directory can be created with mode 0755 and files with mode 0644. On a multi-user system, this can allow other local accounts to enumerate the directory and read its records. The stored content may include campaign configurations, audience or segmentation details, prompts, costs, usage data, test results, and other confidential business information.

The same issue affects files created later through shell redirection, including command-specific logs, history.log, and exported reports. The implementation also does not repair insecure permissions when the data directory or files already exist.

Attack Path

1. A user runs an argument-bearing command and records confidential information, such as campaign metrics or audience details.
2. The script creates the data directory and corresponding log files using permissions derived from the user's current umask.
3. In an environment with permissive defaults, those files become readable by other local users.
4. Another local account enumerates ~/.local/share/email-marketer/ and reads its .log, .json, .csv, or .txt files.
5. The attacker obtains the marketing records without authorization.

Exploitation requires local access under another account and sufficiently permissive filesys ...[truncated 554 chars]

Remediation

View remediation

Remediation Suggestions

Set a restrictive umask before creating any storage:

bash

umask 077
DATA_DIR="${HOME}/.local/share/email-marketer"
mkdir -p -m 700 "$DATA_DIR"
chmod 700 "$DATA_DIR"

Ensure every log and export file is owner-readable and owner-writable only:

bash

touch "$DATA_DIR/history.log"
chmod 600 "$DATA_DIR/history.log"

Apply the same 0600 permission to command logs and export files. Because mkdir -p does not correct an existing directory's mode, explicitly use chmod 700 after creation. Existing installations should include a migration that restricts all previously generated files:

bash

find "$DATA_DIR" -type f -exec chmod 600 {} +

Avoid storing personal data, credentials, mailing-list contents, or other secrets unless such storage is explicitly required and protected appropriately.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:74

Finding

CSV Export Allows Spreadsheet Formula Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 74–80
Vulnerability Type: CSV formula injection and malformed CSV generation
Risk Level: Medium

Vulnerable Code

bash

csv)
    echo "type,time,value" > "$out"
    for f in "$DATA_DIR"/*.log; do
        [ -f "$f" ] || continue
        local name=$(basename "$f" .log)
        while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f"
    done
    ;;

Technical Analysis

The exporter places log values directly into comma-separated output without CSV escaping, field quoting, or spreadsheet-formula neutralization. The val field ultimately contains user-controlled command input.

Values beginning with spreadsheet formula indicators such as =, +, -, or @ may be interpreted as formulas when the export is opened in compatible spreadsheet software. Depending on the spreadsheet product and its security settings, a crafted formula may trigger external network requests, expose spreadsheet data, or present deceptive links and content.

The implementation also fails to escape commas, double quotes, carriage returns, and newlines. These characters can alter columns or create additional rows, allowing attacker-controlled content to manipulate the apparent structure of the report.

Attack Path

1. An attacker persuades a user to record a crafted campaign value, or supplies data that the user passes to one of the logging commands.
2. The value begins with a formula marker, for example a spreadsheet expression that initiates an external request.
3. The user runs email-marketer export csv.
4. The untrusted value is copied verbatim into ~/.local/share/email-marketer/export.csv.
5. The user opens the export in formula-capable spreadsheet software.
6. The spreadsheet interprets the attacker-controlled cell as a formula rather than plain text.
7. Depending on the spreadsheet implementation and configured p ...[truncated 860 chars]

Remediation

View remediation

Remediation Suggestions

Generate standards-compliant CSV by enclosing every field in double quotes and replacing each embedded double quote with two double quotes. Normalize or reject embedded carriage returns and newlines if multiline fields are not required.

Before writing user-controlled values intended for spreadsheet consumption, neutralize cells whose first non-whitespace character is =, +, -, or @. One common mitigation is to prefix such values with an apostrophe so spreadsheet applications treat them as text.

Prefer implementing export through a well-tested CSV library in a language with reliable CSV support. Add tests covering:

• Formula-prefixed values
• Commas inside values
• Embedded double quotes
• Carriage returns and newlines
• Empty fields
• Unicode content

Document that exported records contain untrusted content and should not be opened with formula execution or external-content retrieval enabled.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a specialized email-marketing planner, but the documented behavior is primarily a generic persistent logging/export tool for arbitrary user input. This mismatch is dangerous because users may provide campaign notes, audience details, or customer-related data under the assumption of a bounded planning tool, while the skill actually stores and exposes that data through search/export functions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata promises email campaign planning, segmentation, A/B testing, and benchmarking, but the script only implements generic local data collection, search, export, and status commands. This mismatch is dangerous because users may provide sensitive campaign prompts, customer segments, or business data under false expectations about functionality, while the real behavior is persistent logging and re-exposure of that data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly logs all entries locally and supports exporting them, but it provides no warning that inputs may include sensitive campaign strategy, customer segmentation details, or other business-sensitive data. In this context, silent retention and export of potentially sensitive marketing data increases the risk of unintentional disclosure, over-collection, and insecure downstream handling.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script is designed around persistent plaintext recording of user-provided content and repeated re-exposure through recent, search, status, and export operations. In the context of an allegedly planning-focused skill, this creates avoidable confidentiality risk because stored campaign inputs and prompts can be accessed later by local users or other processes with file access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The command surface includes broad toolkit-style functions such as configure, prompt, fine-tune, cost, usage, export, search, and status that are not clearly necessary for an email-marketing planning skill. In this context, unnecessary capabilities increase the chance of covert data collection and broaden the exposure of stored user inputs without delivering the claimed domain-specific functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The export feature aggregates previously logged plaintext activity into new files without prominently warning that historical user content will be copied and repackaged. This increases the risk of accidental disclosure by making sensitive inputs easier to share, move, or ingest into other systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These command handlers append raw user input to persistent log files and history without any explicit warning, consent flow, or data minimization. For a marketing-oriented skill, users may enter confidential campaign ideas, audience data, or performance notes, which then remain on disk in plaintext and can be re-read later.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.