Security audit

sms

Security checks for vulnerabilities and agentic risk

Overview

This skill provides SMS marketing strategy and templates with prominent compliance guidance and no executable or hidden behavior.

Review this as marketing and compliance guidance, not legal advice. Before using any campaign templates, confirm that recipients have valid SMS consent, behavioral tracking is lawful for your jurisdiction, STOP/HELP handling works, quiet hours are enforced, and any A2P 10DLC or platform registration requirements are complete.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: This JSON manifest contains free-form user prompts that appear to define when the skill is invoked, but they are broad, everyday business questions rather than narrowly scoped trigger phrases. The file provides no negative examples or activation boundaries, increasing the risk of unintended invocation overlap with general marketing advice requests.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: This markdown file provides abandoned-cart and browse-abandonment messaging that relies on tracking purchase and browsing behavior, but the surrounding description does not clearly warn users that these flows depend on consented customer data and applicable privacy/SMS compliance requirements. While some later sections mention consent in specific cases, these behavioral targeting sections present ready-to-use templates without an accompanying user-facing caution about privacy and compliant use.

Static analysis

No suspicious patterns detected.