Security audit

Agentic Case Study Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated local proof-asset purpose, but its PDF renderer has under-scoped rendering inputs and dependency-risk signals that deserve review before installation.

Review this skill before installing in environments that handle untrusted case-study metadata or restrict outbound network access. Use only trusted title/subtitle/doc-type values, avoid optional PNG generation until dependency advisories are resolved, and prefer running it in a workspace where generated output paths cannot overwrite important files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/render_pdf.py:456
Finding: Untrusted Cover Metadata Is Parsed as ReportLab Rich Text
Content: View full analysis
Remediation: View remediation
` elements with HTTP, HTTPS, and local paths. - Unknown and malformed tags. - Entity-encoded markup. - Oversized markup and very long metadata values. - Expected safe formatting such as approved bold text. 5. Where possible, deny outbound network access at the process or sandbox level so a future rendering-parser defect cannot violate the local-only boundary. 6. Restrict logo and other local resource paths to explicitly approved files or directories when inputs may originate outside a trusted local user context. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about generating specific engagement-proof and marketing content artifacts such as case studies, testimonials, interview guides, anonymization checks, and approval-gated summaries. The supplied code does not implement any of that domain logic. Instead, it is a reusable rendering utility: it reads a Markdown file, applies CompleteTech branding, produces a PDF, and optionally renders all PDF pages into a PNG montage. It contains formatting/presentation behavior only, not content-generation workflows, intake/questionnaire logic, anonymization validation, client-approval handling, testimonial drafting, or proof packaging controls. While such a renderer could support producing those assets, its actual primary purpose is materially different and undeclared, so this is a mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
- Runs local Python entry points `scripts/render_proof.py` and `scripts/render_pdf.py`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
- Runs local Python entry points `scripts/render_proof.py` and `scripts/render_pdf.py`.

Known Vulnerable Dependency: pillow==12.2.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The file pins Pillow to version 12.2.0, which the finding indicates is affected by multiple published advisories, including image parsing and command-injection related issues. Because this skill renders branded PDF artifacts and optionally emits PNG previews, it likely processes image/font/document inputs, making a vulnerable imaging library materially relevant rather than incidental.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill explicitly states filesystem read/write behavior and output-path handling, but it does not declare an enforceable tool scope such as permissions or allowed-tools. That creates a policy gap: a host may grant broader file access than intended, enabling accidental exposure or overwrite of local files if the renderer or user inputs are misused.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · assets/examples/example.md (reported line 32)May include surrounding context.
md
| Routing accuracy (held-out labeled set) | 93.4% | | Reply-quality rubric average | 4.3 / 5 | | Prompt-injection attempts triggering tool actions | 0 of 42 | | Customer-facing replies sent without approval | 0 | ## 5. Qualitative Observations

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs file reads and writes, including creating output directories and saving rendered PDF/PNG artifacts, but it does not include a user disclosure that local files will be accessed and new files created. The existing print statements only report completed outputs and do not warn beforehand about filesystem modifications.
Content: No source excerpt is available for this finding.