Agentic Delivery Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.0.9

Overview

This skill is a local-only delivery-document template and PDF renderer with disclosed file outputs and no evidence of hidden network, credential, persistence, or destructive behavior.

Install only if you want a local CompleteTech-branded delivery artifact generator. Treat generated documents as drafts, review all placeholders and approval-sensitive claims before use, and consider updating or omitting the optional PNG preview dependency until the Pillow pin is current.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises creation of many specific delivery execution artifacts for bounded agentic development engagements. However, the code shown does not create those artifacts semantically; it only formats existing Markdown into branded PDF output and optionally a PNG contact sheet. There is no logic for kickoff agendas, access checklists, milestone trackers, status updates, risk logs, change requests, launch readiness, support handoff, or escalation procedures beyond whatever text might already exist in the input Markdown. This is a materially different primary purpose: rendering/publishing documents rather than producing delivery-execution artifacts. No suspicious extra permissions or external access are evident, but the core behavior is narrower and different from the declared skill purpose.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

| Local commands | `scripts/render_delivery.py` and `scripts/render_pdf.py`. |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

| Local commands | `scripts/render_delivery.py` and `scripts/render_pdf.py`. |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

| List artifacts for a stage | `python3 scripts/render_delivery.py --stage status --list` |
| Render a kickoff agenda | `python3 scripts/render_delivery.py --template kickoff-agenda --var client_name=Acme --var workflow="support triage"` |

| Output Rule | Requirement |
|---|---|
| Draft status | Rendered artifacts remain drafts until verified by the delivery owner. |
| Placeholders | Replace every placeholder with verified project facts before sending, storing, or using as evidence. |

Known Vulnerable Dependency: pillow==12.2.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is pinned to pillow==12.2.0, and the finding reports multiple published advisories affecting that exact version, including decompression-bomb related denial-of-service conditions and a Windows command-injection issue. In this skill's context, Pillow is used for PNG preview generation from rendering scripts, so if the workflow processes untrusted images, fonts, or viewer-related paths, the vulnerable library could expose the delivery environment to crashes, resource exhaustion, or potentially command execution on affected platforms.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The script creates output directories and writes a PDF artifact through build_pdf(), but there is no confirmation prompt and only a post-write message is printed after the file is created. Under SQP-2, file writes in code should have some visible disclosure; here the user learns the path after the write rather than before it occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This code performs a file write via --markdown-out, creating parent directories and overwriting the target file content, but there is no explicit confirmation prompt at the write site. While the operation is user-directed, SQP-2 for code files asks for some visible disclosure around file writes; this branch has no print/log/comment specifically warning that the file will be written.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill for producing specific delivery execution artifacts for approved agentic engagements, but this file is a generalized, reusable branding renderer for 'every skill in the library' and is framed as a shared document-rendering utility. That rendering capability is not specific to delivery execution artifacts and expands the skill into a generic document production tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs file-writing operations by creating output directories and building a PDF, and later may save a PNG montage. While the script's purpose is rendering documents, there is no confirmation prompt or explicit runtime notice before these writes occur beyond a success message after completion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The code reads from an arbitrary path provided via --markdown, which is a filesystem access operation. Although expected for a renderer, there is no explicit user disclosure in code comments or runtime messaging that the tool will open and process local files from the supplied path.

Content

No source excerpt is available for this finding.