Social Media Commander

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for social media management, but it installs active permanent scheduled tasks and automatic workspace writes without clear user-controlled cancellation or approval boundaries.

Review before installing. The main concern is not malicious code, but always-on scheduled automation and broad write triggers. Use it only in a workspace where persistent social-media reports, drafts, analytics updates, and audience records are acceptable, and disable or remove the active cron files unless you intentionally want recurring unattended updates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T06 · System Persistence

Error

• Location: crons/active/calendar-health-check.md:1
• Finding: Permanent Calendar Health-Check Scheduled Task## Vulnerability Details **File Location**: `crons/active/calendar-health-check.md`, lines 1-16 **Vulnerability Type**: Persistent scheduled task **Risk Level**: High ### Vulnerable Code ```yaml --- name: calendar-health-check type: permanent schedule: "0 4 * * 5" schedule_ist: "09:30 IST every Friday" timezone: Asia/Kolkata purpose: Check content calendar health — ensure 14 days ahead pipeline fire_once: false auto_delete: false status: active --- # Calendar Health Check — Permanent Fires every Friday at 09:30 IST. Check: how many days of approved/scheduled content exist per platform. < 14 days → advisory to owner with content suggestions. THIS FILE MUST NEVER BE DELETED. ``` ### Technical Analysis The configuration declares an active recurring task using `type: permanent`, `fire_once: false`, and `auto_delete: false`. It additionally instructs the Agent that the file must never be deleted. In a compatible runtime that automatically processes files under `crons/active/`, loading this Skill may register a task that continues to execute after the initiating session. The scheduled operation is limited to inspecting the content calendar and generating recommendations. No evidence indicates that this file directly creates an operating-system crontab, executes shell commands, accesses credentials, or contacts an external destination. Nevertheless, the unbounded cross-session schedule and explicit resistance to deletion constitute Skill-level persistence. ### Attack Path 1. A user installs or loads the Skill in a runtime that processes `crons/active/`. 2. The runtime reads the active cron metadata. 3. The schedule causes the calendar check to run every Friday. 4. `fire_once: false` permits repeated execution. 5. `auto_delete: false` retains the scheduled task after execution. 6. The non-deletion instruction directs the Agent to preserve the file indefinitely. 7. The task continues inspecting w ...[truncated 717 chars]
• Remediation: ## Remediation Suggestions - Replace `type: permanent` with a bounded or explicitly user-managed lifecycle. - Default the task to inactive and require informed owner consent before registration. - Set an expiration date, maximum execution count, or renewal interval. - Remove `THIS FILE MUST NEVER BE DELETED`. - Permit automatic cleanup and provide a documented cancellation mechanism. - Do not register the schedule merely because the Skill is loaded. - Display the schedule, next execution time, data accessed, and cancellation controls before activation.

T06 · System Persistence

Error

• Location: crons/active/monthly-strategy.md:1
• Finding: Permanent Monthly Strategy Scheduled Task## Vulnerability Details **File Location**: `crons/active/monthly-strategy.md`, lines 1-16 **Vulnerability Type**: Persistent scheduled task **Risk Level**: High ### Vulnerable Code ```yaml --- name: monthly-strategy type: permanent schedule: "0 4 1 * *" schedule_ist: "09:30 IST 1st of every month" timezone: Asia/Kolkata purpose: Monthly analytics compile, strategy review, competitor updates, new month planning fire_once: false auto_delete: false status: active --- # Monthly Strategy Cron — Permanent Fires 1st of every month at 09:30 IST. Compile monthly analytics, review all platform strategies, update competitor entries, plan content calendar for new month. THIS FILE MUST NEVER BE DELETED. ``` ### Technical Analysis This file configures an active, indefinite monthly task. The combination of `type: permanent`, `fire_once: false`, `auto_delete: false`, and the instruction prohibiting deletion establishes cross-session persistence in runtimes that honor the Skill's cron metadata. The task has write-capable behavior: it compiles analytics, updates competitor entries, reviews platform strategies, and plans a new content calendar. Consequently, it may modify persistent workspace state on every execution without requiring renewed approval. No evidence demonstrates operating-system cron installation, command execution, credential access, or external transmission. The confirmed issue is persistence through the Skill scheduler rather than host-level compromise. ### Attack Path 1. The Skill is loaded into a runtime that recognizes active cron definitions. 2. The runtime registers the monthly schedule from this file. 3. On the first day of each month, the recurring task processes analytics, strategies, competitor records, and calendar data. 4. `fire_once: false` keeps execution recurring. 5. `auto_delete: false` prevents automatic retirement. 6. The explicit non-deletion instruction discourages manu ...[truncated 615 chars]
• Remediation: ## Remediation Suggestions - Require explicit owner confirmation before creating the monthly schedule. - Replace permanent activation with a disabled-by-default configuration. - Introduce an expiration date or finite execution count. - Remove the instruction that the file must never be deleted. - Allow users and administrators to disable or delete the task at any time. - Require confirmation before making substantive changes to strategy, competitor, or calendar files. - Record every scheduled execution and resulting file modification in an auditable log. - Restrict the task to the minimum required workspace paths.

T06 · System Persistence

Error

• Location: crons/active/weekly-review.md:1
• Finding: Permanent Weekly Review Hook Execution## Vulnerability Details **File Location**: `crons/active/weekly-review.md`, lines 1-15 **Vulnerability Type**: Persistent scheduled hook execution **Risk Level**: High ### Vulnerable Code ```yaml --- name: weekly-review type: permanent schedule: "30 3 * * 1" schedule_ist: "09:00 IST every Monday" timezone: Asia/Kolkata purpose: Weekly analytics review, funnel balance check, calendar health, growth journal fire_once: false auto_delete: false status: active --- # Weekly Review Cron — Permanent Fires every Monday at 09:00 IST. Execute hooks/weekly-review.md in full. THIS FILE MUST NEVER BE DELETED. ``` ### Technical Analysis This cron definition creates an active and unbounded weekly execution channel. Unlike a task containing all behavior locally, it delegates execution to `hooks/weekly-review.md`. That hook compiles platform metrics, analyzes funnel and content-pillar balance, writes a weekly analytics report, updates `GROWTH_JOURNAL.md`, updates persistent soul sections, and appends to the session log. The scheduler metadata prevents one-shot retirement and automatic deletion, while the final instruction directs the Agent never to remove the persistence definition. Because the scheduled file invokes another file “in full,” later modifications to that hook could alter the effective recurring behavior without changing this cron entry. No evidence shows remote payload retrieval, executable script invocation, operating-system cron modification, or command execution. The vulnerability is confined to persistent Skill-level scheduled hook execution. ### Attack Path 1. A compatible Agent runtime loads the Skill and scans `crons/active/`. 2. The runtime registers the active Monday schedule. 3. At the scheduled time, the task executes `hooks/weekly-review.md` in full. 4. The hook reads platform, funnel, calendar, hashtag, and analytics state. 5. It writes weekly reports, updates the growth journal and ...[truncated 877 chars]
• Remediation: ## Remediation Suggestions - Disable automatic registration when the Skill is loaded. - Require explicit owner consent that identifies the delegated hook and every file it may read or modify. - Replace permanent recurrence with an expiring schedule or finite execution count. - Remove `THIS FILE MUST NEVER BE DELETED` and expose immediate cancellation controls. - Pin or integrity-check the invoked hook so its behavior cannot change silently after schedule approval. - Require renewed approval if `hooks/weekly-review.md` changes. - Constrain scheduled writes to an allowlist of task-specific files. - Maintain an execution log recording trigger time, hook version, inputs, outputs, and modified paths.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (32)

Hidden Instructions

High

• Category: Prompt Injection

Content

---

## [PLATFORM PRESENCE]
<!-- One entry per active platform. Upsert. -->
<!-- Format: PLATFORM | FOLLOWERS | FOLLOWING | POSTS | AVG_ENGAGEMENT% | LAST_POST -->

---

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

---

## [CONTENT PIPELINE]
<!-- Current content pipeline summary. Update daily. -->
<!-- Format: ideas:N | drafts:N | review:N | approved:N | scheduled:N | published_this_week:N -->

---

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

---

## [FUNNEL HEALTH]
<!-- Current funnel balance. Update weekly. -->
<!-- Format: AWARENESS:N% | CONSIDERATION:N% | CONVERSION:N% | RETENTION:N% | ADVOCACY:N% -->

---

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

---

## [HASHTAG PERFORMANCE]
<!-- Top and bottom performing hashtag sets. -->
<!-- Format: SET_NAME | AVG_REACH | TREND | LAST_REVIEWED -->

---

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

| Rule | Reason |
|---|---|
| Always credit sources for data/stats | Trust |
| Always respond to direct questions in comments | Community |
| Always use brand hashtag set on every post | Discovery |
| Always include one clear CTA per post | Conversion |
| Always proofread for typos before approving | Quality |

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Hidden Instructions

High

• Category: Prompt Injection

Content

- #tag

## Always-On Brand Hashtags
<!-- Used on every post -->
- #[brand-hashtag]

## Campaign Hashtags

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

- Rejection reason: [if rejected]

## Performance
<!-- Filled post-publish -->
### 1-Hour
- Reach: | Likes: | Comments: | Saves: | Shares:

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The rule activates on very broad, ordinary phrases related to content creation and instructs the agent to immediately write files, which can cause unintended skill invocation and persistence from casual conversation. In a multi-purpose assistant context, this increases the chance of misinterpreting brainstorming or offhand remarks as commands, leading to unwanted state changes and content creation without explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly maintains folders for engagement comments, direct messages, mentions, audience segments, personas, and competitor analysis, but the top-level description does not warn that it processes and stores potentially sensitive communications and profiling data. This creates a transparency and privacy risk: users may enable or use the skill without understanding that private or personal data will be retained in the workspace, increasing the chance of inappropriate collection, over-retention, or accidental exposure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The description says the hook 'Fires when owner mentions a content idea' but does not disclose that it will immediately create a draft entry and update the pipeline. This hidden side effect undermines informed consent and increases the risk of silent, unintended modifications to user content management state.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger is broad enough to fire on casual conversation and uses an open-ended catch-all ('or similar'), which can cause unintended activation and automatic state changes. In this skill, that means creating persistent draft entries and modifying the content pipeline without a clearly bounded user intent signal.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description says the hook "Fires when content is published," but it does not define what event counts as publishing, who triggers it, or any exclusions. In a manifest-style markdown header, this is an ambiguous activation condition that could cause the skill to run in unintended publishing-related contexts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file instructs the skill to move files between review folders, log rejection reasons, and 'Apply changes immediately' on edit, but it provides no warning about altering stored content or review state. For markdown files, safety-relevant behaviors that affect user data or system integrity should be disclosed explicitly.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The hook instructs the agent to write a weekly analytics report into the repository automatically, but it does not disclose or gate that repository modification with an explicit user warning or confirmation step. In an automated hook context, silent writes can surprise users, overwrite expected content, and create an integrity risk if the hook runs on a schedule without review.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The later steps direct the agent to update additional files such as GROWTH_JOURNAL.md and "Soul" state automatically, again without clear disclosure of write behavior or limits on what may be modified. Because these are broad update instructions in a scheduled hook, they increase the chance of unintended repository changes, state corruption, or hidden persistence of generated content.

Static analysis

No suspicious patterns detected.