marketing-plan

• Outcome: Review
• Latest audit: Jul 30, 2026 · 5:44 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent marketing-plan generator, but it directs broad reading of client files and connected business systems with insufficient per-source approval and persistence controls.

Install only if you are comfortable with the agent reading the selected client's local materials folder, using connected analytics/billing/marketing/source-control tools for that client, and storing derived strategy files under ~/marketing-plans. Before running it, limit the materials folder to approved documents, disable or withhold connectors you do not want queried, and require an explicit review before any GitHub publication.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill goes beyond drafting a local marketing plan and instructs optional cloning, copying, committing, and pushing content to a GitHub repository. That expands the action surface from document generation to external write operations, which can cause unintended publication of sensitive business strategy, internal notes, or machine-local content if the target path or repo is wrong.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The methodology directs the agent to pull live data from multiple connected systems including analytics, billing, app store, email, commerce, source control, and internal knowledge tools. For a marketing-plan skill, this is broad data access that may exceed least-privilege needs and can expose sensitive financial, customer, and operational information beyond what is necessary for many planning tasks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to read and write files under ~/marketing-plans/{client-slug}/, including research, progress, and final deliverables, but does not require explicit user consent or a user-facing warning that local data will be accessed and persisted. This creates a privacy and data-governance risk because sensitive client materials, strategic notes, and derived outputs may be stored or resumed later without the user's clear awareness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill directs the agent to pull data from external tools such as analytics and billing integrations and later optionally publish output to GitHub, but it does not require a clear privacy notice, scope limitation, or explicit approval before accessing or sharing client data. In a marketing-consulting context, these sources can contain sensitive business metrics, customer data, and confidential strategy, so silent collection or disclosure increases the risk of unintended data exposure.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The eval prompt uses a broad natural-language phrase ('pick up where we left off') that overlaps with common conversational input, which can cause the skill to trigger unexpectedly outside tightly scoped command usage. In this skill, that matters because the expected behavior includes reading and resuming from a local progress file, so an accidental trigger could lead to unintended file access or stateful workflow continuation.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The instruction to read all client-provided files encourages indiscriminate ingestion of whatever is placed in the materials folder, including sensitive decks, transcripts, research, and internal notes. Without a warning, filtering step, or minimization guidance, the agent may process confidential or irrelevant data that the user did not intend to expose for this task.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The methodology tells the agent to pull potentially sensitive analytics, revenue, churn, customer messaging, and internal knowledge data from connected services without an explicit user-facing warning at the time of access. This creates a transparency and consent gap, increasing the risk of overcollection and surprising access to business-sensitive systems.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **GitHub MCP** → repos inventory, last commit dates, what's stale
- **Notion** → internal knowledge directory if exposed

Don't ask the user to copy/paste data that can be pulled directly.

### Step 1.4 — Conduct structured intake

• Confidence: 80% confidence
• Finding: The phrase 'Don't ask the user to copy/paste data that can be pulled directly' pushes the agent toward autonomous retrieval decisions instead of user-mediated disclosure. In a skill with many connected systems, this can normalize accessing live data without sufficiently granular confirmation, especially when the data is sensitive or not strictly necessary.

Self-Modification

High

• Category: Rogue Agent

Content

1. Read `skills/marketing-ideas/references/ideas-by-category.md` in the `marketingskills` repo
2. Assign each new idea to a primary AARRR stage using the rules above
3. Add to this doc's tables
4. Update SKILL.md's idea-count reference

## Sources

• Confidence: 89% confidence
• Finding: The file includes explicit maintenance instructions to read another repository path, modify this document, and update SKILL.md. In an agentic environment with file-write capabilities, such self-modification guidance can cause the agent to alter skill definitions or adjacent repository content based on untrusted prompts, creating integrity and supply-chain risk even though the apparent author intent is benign.

Static analysis

No suspicious patterns detected.