Security audit

Monet Works — Content QA Remediation

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local content QA tool, but users should review its automatic edits before publishing financial or brand-sensitive material.

Use this skill only when automatic editorial remediation is acceptable. Send output to a separate file, review the JSON report and final text before scheduling or publishing, customize CTA/disclaimer templates for your organization, and skip the unnecessary unpinned LLM package install unless the implementation is updated to require it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: scripts/auto-remediate.py:281
Finding: Forced Promotional Content Injection Through Automatic CTA Remediation
Content: View full analysis
tuple[str, dict[str, Any]]: """Append CTA if not already present.""" type_key = content_type if content_type in cta_templates else "general" tmpl = cta_templates[type_key] detection_signals = tmpl.get("detection_signals", []) already_present = any( re.search(re.escape(signal), content, re.IGNORECASE) for signal in detection_signals ) if already_present: return content, { "issue_type": issue["issue_type"], "original_text": issue.get("original_text", ""), "fixed_text": "(CTA already present — skipped)", "auto_fixed": True, "reason": "CTA signal detected in content — no injection needed.", "action": "skipped", } cta_variant = variant if variant in tmpl else "default" cta_text = tmpl[cta_variant] fixed_content = content.rstrip() + cta_text return fixed_content, { "issue_type": issue["issue_type"], "original_text": issue.get("original_text", ""), "fixed_text": cta_text.strip(), "auto_fixed": True, "reason": f"Appended {type_key}/{cta_variant} CTA template.", "action": "appended", "template_used": f"{type_key}.{cta_variant}", } ``` Representative bundled payloads include: ```json "financial": { "default": "\n\n**Ready to put these insights to work?** Subscribe to our newsletter for weekly market analysis, or book a free consultation to discuss your portfolio strategy.", "newsletter": "\n\n**Found ...[truncated 3494 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:24
Finding: Unnecessary Installation of Unpinned Third-Party Packages
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly promotes automatic remediation and writing fixed content directly to output files, but it does not warn users to review changes before publication or to avoid overwriting authoritative drafts. In a publication pipeline, this can silently alter legal, marketing, or brand-sensitive content and propagate incorrect or unauthorized edits downstream.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 84% confidence
Finding: The skill describes autonomous content decisions such as automatically removing, rephrasing, or appending text without requiring user confirmation. In this context, that can introduce factual, legal, compliance, or messaging errors at the final pre-publication stage, especially because the tool also adds disclaimers and context-aware CTAs on its own.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
1. **Banned Phrases:** * *Detects:* A list of 37+ banned phrases (e.g., "in conclusion," "game-changer," "level up"). * *Fix:* Automatically removes or rephrases them. 2. **Missing Disclaimers:** * *Detects:* If the content discusses investments, finance, or taxes without the standard legal disclaimer.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description states that banned phrases and approved alternatives are mandated for 'Monet Works content' based on brand voice guidelines. This is a natural-language policy constraint that forces a specific wording regime without any indication of user choice, opt-in, or documented scope limitation such as a region-specific compliance requirement.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON file is a manifest/config-type file, so vague-trigger review applies. The detection_signals list includes broad everyday phrases like "learn more" and "get started," which are common in ordinary content and can overlap with many unrelated contexts, increasing the chance of unintended CTA classification or invocation behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The signals "contact," "reach out," "visit," "learn more," "get started," and "click here" are highly generic and commonly appear in normal prose. Without documented exclusions or narrower context, these broad triggers can match benign text and cause overly aggressive CTA detection.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 60% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · scripts/auto-remediate.py (reported line 354)May include surrounding context.
python
"original_text": f"{original_wc} words", "fixed_text": f"{original_wc} words (within limit)", "auto_fixed": True, "reason": f"Word count {original_wc} is within the {max_words}-word limit — no truncation needed.", "action": "skipped", }

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says the pipeline detects and repairs common content issues limited to banned phrases, missing disclaimers, missing CTAs, and excessive length. This report includes a separate tone_misalignment issue requiring human review, which indicates the skill analyzes content quality dimensions beyond the declared scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON contains natural-language content that is hard-coded in English, including a disclaimer and later a call to action. Because the file provides no indication of user opt-in, language selection, or justified locale restriction, it may violate language/locale policy for multilingual environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The appended call-to-action text is fixed in English and appears to be automatically injected from a template. Without a documented locale constraint or user choice, this can conflict with organizational policies requiring language flexibility or explicit opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.