Security audit

Agentic Customer Success Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local customer-success document drafting and rendering helper with no hidden network, credential, persistence, or destructive behavior found.

Reasonable to install for drafting local customer-success artifacts, but treat generated communications as drafts requiring human review. Before using optional PNG preview or untrusted Markdown/logo inputs, review and update pinned rendering dependencies, especially Pillow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose describes a business-content generation skill for managing customer success and account management artifacts across the client lifecycle. The supplied code does not implement logic specific to account profiles, contact maps, routing approvals, meeting notes, health/risk/renewal tracking, QBRs, escalations, surveys, or any customer relationship workflows. Instead, it is a shared rendering utility that formats arbitrary Markdown into branded PDFs and optionally PNG montages. This is a materially different primary purpose and introduces undeclared export/rendering capabilities unrelated to the stated skill description. There is no evidence of CRM-like data handling or artifact-specific generation behavior in this code chunk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
- Runs local Python entry points `scripts/render_customer_success.py` and `scripts/render_pdf.py`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
md
- Runs local Python entry points `scripts/render_customer_success.py` and `scripts/render_pdf.py`.

Known Vulnerable Dependency: pillow==12.2.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The file pins Pillow to version 12.2.0, and the static analysis indicates that version is associated with multiple published advisories, including denial-of-service conditions from missing decompression bomb checks and command-injection risk in platform-specific viewer handling. Even though this skill is focused on customer success artifacts, it explicitly supports PNG/PDF rendering, so image-processing code may handle untrusted or externally supplied assets such as logos, screenshots, or attachments, making vulnerable image libraries materially relevant.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The module docstring says this renderer was generalized so the same CompleteTech branding can be applied to every skill in the library, making it a cross-skill document production utility rather than something specific to customer-success artifacts. While rendering PDFs for customer-success documents is plausibly useful, a library-wide branded renderer is broader than the manifest's narrowly described customer relationship management scope.
Content: No source excerpt is available for this finding.