marketing-plan

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it can read, persist, and optionally publish sensitive client marketing and business data with insufficient consent checkpoints.

Review before installing. Use this skill only if you are comfortable with an agent reading client materials, accessing connected analytics, billing, repo, knowledge-base, social, and ad systems, and writing persistent plan files under ~/marketing-plans/. Confirm each data source and any GitHub publish destination before allowing access or writes, and avoid unpinned global tool installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/ops-stack-mapping.md:106

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: references/ops-stack-mapping.md:106
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

| **agent-browser** | Browser automation (form fills, screenshots, scraping) | CLI install: `npm install -g agent-browser` |

Technical Analysis

The Skill recommends installing the latest available version of the agent-browser npm package globally. The command does not specify a reviewed version, verify package integrity, identify an authoritative source repository, or require review of package lifecycle scripts.

Because npm package versions and transitive dependencies are mutable supply-chain inputs, following this instruction may execute unreviewed installation scripts with the user's privileges. A compromised package release, maintainer account, or transitive dependency could therefore introduce arbitrary code after the Skill itself has been audited.

The global installation scope increases the consequence: package files and executable shims are placed in the user's global Node.js environment rather than being isolated to a project. The audited project does not itself contain a malicious payload, so malicious intent is not established; the vulnerability is the unsafe dependency-installation practice.

Attack Path

1. An attacker compromises the agent-browser package, its publisher account, or one of its transitive dependencies.

2. The attacker publishes a malicious release containing an npm lifecycle script or modified executable.

3. A user follows the Skill's recommendation and runs:

   bash

   npm install -g agent-browser
   

4. npm resolves the current package release because no version is pinned.

5. Malicious lifecycle code executes during installation with the permissions of the invoking user.

6. The installed global executable may continue to run attacker-controlled behavior whenever called.

Impact Assessment

Successful exploitation ...[truncated 688 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned command with a pinned, reviewed package version:

   bash

   npm install --global agent-browser@<reviewed-version>
   

2. Verify and document the package's official npm namespace, publisher, and authoritative source repository to reduce typosquatting and package-substitution risk.

3. Review the selected release, its transitive dependencies, and all npm lifecycle scripts before recommending installation.

4. Record and verify the expected package integrity hash where the installation process supports it.

5. Prefer project-local installation with a committed lockfile over global installation:

   bash

   npm install --save-dev --save-exact agent-browser@<reviewed-version>
   

6. Use npm ci with a reviewed lockfile in controlled environments.

7. Disable lifecycle scripts during installation when they are unnecessary:

   bash

   npm install --ignore-scripts --save-dev --save-exact agent-browser@<reviewed-version>
   

8. Prefer an already-approved browser automation tool when one is available in the user's environment.

9. Require explicit user approval before installing any new third-party executable or MCP integration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/funding-stage-unlocks.md (reported line 215)May include surrounding context.

md

If a founder asks for moves that require a future tier:
- Name the requirement: "This is a Tier 2 move (requires $10K+/mo paid budget). Will unlock after seed close per the 12-month outlook in §10."
- Don't refuse — frame the timing

If a founder underestimates what's needed:
- Be honest: "To scale paid acquisition meaningfully, expect Tier 2 budget. Tier 1 can validate organic; Tier 2 validates paid."

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/idea-cross-reference.md (reported line 260)May include surrounding context.

md

1. Read `skills/marketing-ideas/references/ideas-by-category.md` in the `marketingskills` repo
2. Assign each new idea to a primary AARRR stage using the rules above
3. Add to this doc's tables
4. Update SKILL.md's idea-count reference

## Sources

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to read and write files under ~/marketing-plans/{client-slug}/ and to persist research, progress, section drafts, and a final plan without an explicit user-facing confirmation step before modifying local data. In an agent environment, this can cause unintended local file creation, overwrite, or accumulation of sensitive client/business information, especially when resumed automatically from prior state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The eval prompt 'we have an audit already done — can you take that and turn it into a real plan' is broad enough to match ordinary conversational requests that may not be intended to invoke this specific skill. In a routing or auto-invocation system, that ambiguity can cause the marketing-plan skill to activate without sufficient context, potentially skipping expected intake steps or pulling the user into a heavyweight workflow unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The resume-style prompt '/marketing-plan acme-saas — pick up where we left off' implies stateful continuation but does not define enough scope constraints around when resume behavior should occur. If similar status-check phrasing is treated as a trigger, the skill could resume the wrong client context, read unintended files, or continue from stale state without clear user confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L195 states the product is 'EN-only and US-centric copy,' which is a natural-language locale constraint. The surrounding text presents this as a default limitation to defer, rather than offering users a language choice or documenting a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/idea-cross-reference.md (reported line 264)May include surrounding context.

md

## Sources

- `skills/marketing-ideas/SKILL.md` (in the `marketingskills` repo)
- `skills/marketing-ideas/references/ideas-by-category.md` (in the `marketingskills` repo)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The methodology directs the agent to pull live data from systems like GA4, Stripe, Shopify, GitHub, and Notion without any user-facing warning, scoping, or per-source consent. These systems can expose sensitive business, financial, customer, and internal operational data, so silent collection materially increases privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The instruction not to ask the user for data that can be pulled directly encourages autonomous access to connected systems without a fresh consent checkpoint. Even if technically convenient, it weakens user awareness and control over what sensitive business information the agent retrieves during execution.

Content

Scanner excerpt · references/methodology.md (reported line 101)May include surrounding context.

md

- **GitHub MCP** → repos inventory, last commit dates, what's stale
- **Notion** → internal knowledge directory if exposed

Don't ask the user to copy/paste data that can be pulled directly.

### Step 1.4 — Conduct structured intake

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The methodology expands from generating a local marketing plan into optionally publishing to GitHub, which introduces a write capability to an external system. That creates risk of unintended data disclosure, publishing sensitive client material, or modifying repositories beyond the user's original expectation for a planning skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Instructing the agent to clone repos, create branches, commit, and push introduces powerful source-control actions unrelated to drafting a marketing plan. If misused or triggered unexpectedly, this could leak confidential plan contents, alter production documentation, or create unauthorized commits in a client repository.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.