Social Media Commander

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for social media management, but it installs active permanent scheduled tasks and automatic workspace writes without clear user-controlled cancellation or approval boundaries.

Review before installing. The main concern is not malicious code, but always-on scheduled automation and broad write triggers. Use it only in a workspace where persistent social-media reports, drafts, analytics updates, and audience records are acceptable, and disable or remove the active cron files unless you intentionally want recurring unattended updates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T06 · System Persistence

Error

• Location: crons/active/calendar-health-check.md:1

Finding

Permanent Calendar Health-Check Scheduled Task

Content

View full analysis

Vulnerability Details

File Location: crons/active/calendar-health-check.md, lines 1-16
Vulnerability Type: Persistent scheduled task
Risk Level: High

Vulnerable Code

yaml

---
name: calendar-health-check
type: permanent
schedule: "0 4 * * 5"
schedule_ist: "09:30 IST every Friday"
timezone: Asia/Kolkata
purpose: Check content calendar health — ensure 14 days ahead pipeline
fire_once: false
auto_delete: false
status: active
---
# Calendar Health Check — Permanent
Fires every Friday at 09:30 IST.
Check: how many days of approved/scheduled content exist per platform.
< 14 days → advisory to owner with content suggestions.
THIS FILE MUST NEVER BE DELETED.

Technical Analysis

The configuration declares an active recurring task using type: permanent, fire_once: false, and auto_delete: false. It additionally instructs the Agent that the file must never be deleted. In a compatible runtime that automatically processes files under crons/active/, loading this Skill may register a task that continues to execute after the initiating session.

The scheduled operation is limited to inspecting the content calendar and generating recommendations. No evidence indicates that this file directly creates an operating-system crontab, executes shell commands, accesses credentials, or contacts an external destination. Nevertheless, the unbounded cross-session schedule and explicit resistance to deletion constitute Skill-level persistence.

Attack Path

1. A user installs or loads the Skill in a runtime that processes crons/active/.
2. The runtime reads the active cron metadata.
3. The schedule causes the calendar check to run every Friday.
4. fire_once: false permits repeated execution.
5. auto_delete: false retains the scheduled task after execution.
6. The non-deletion instruction directs the Agent to preserve the file indefinitely.
7. The task continues inspecting w ...[truncated 717 chars]

Remediation

View remediation

Remediation Suggestions

• Replace type: permanent with a bounded or explicitly user-managed lifecycle.
• Default the task to inactive and require informed owner consent before registration.
• Set an expiration date, maximum execution count, or renewal interval.
• Remove THIS FILE MUST NEVER BE DELETED.
• Permit automatic cleanup and provide a documented cancellation mechanism.
• Do not register the schedule merely because the Skill is loaded.
• Display the schedule, next execution time, data accessed, and cancellation controls before activation.

T06 · System Persistence

Error

• Location: crons/active/monthly-strategy.md:1

Finding

Permanent Monthly Strategy Scheduled Task

Content

View full analysis

Vulnerability Details

File Location: crons/active/monthly-strategy.md, lines 1-16
Vulnerability Type: Persistent scheduled task
Risk Level: High

Vulnerable Code

yaml

---
name: monthly-strategy
type: permanent
schedule: "0 4 1 * *"
schedule_ist: "09:30 IST 1st of every month"
timezone: Asia/Kolkata
purpose: Monthly analytics compile, strategy review, competitor updates, new month planning
fire_once: false
auto_delete: false
status: active
---
# Monthly Strategy Cron — Permanent
Fires 1st of every month at 09:30 IST.
Compile monthly analytics, review all platform strategies, update competitor entries,
plan content calendar for new month.
THIS FILE MUST NEVER BE DELETED.

Technical Analysis

This file configures an active, indefinite monthly task. The combination of type: permanent, fire_once: false, auto_delete: false, and the instruction prohibiting deletion establishes cross-session persistence in runtimes that honor the Skill's cron metadata.

The task has write-capable behavior: it compiles analytics, updates competitor entries, reviews platform strategies, and plans a new content calendar. Consequently, it may modify persistent workspace state on every execution without requiring renewed approval.

No evidence demonstrates operating-system cron installation, command execution, credential access, or external transmission. The confirmed issue is persistence through the Skill scheduler rather than host-level compromise.

Attack Path

1. The Skill is loaded into a runtime that recognizes active cron definitions.
2. The runtime registers the monthly schedule from this file.
3. On the first day of each month, the recurring task processes analytics, strategies, competitor records, and calendar data.
4. fire_once: false keeps execution recurring.
5. auto_delete: false prevents automatic retirement.
6. The explicit non-deletion instruction discourages manu ...[truncated 615 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit owner confirmation before creating the monthly schedule.
• Replace permanent activation with a disabled-by-default configuration.
• Introduce an expiration date or finite execution count.
• Remove the instruction that the file must never be deleted.
• Allow users and administrators to disable or delete the task at any time.
• Require confirmation before making substantive changes to strategy, competitor, or calendar files.
• Record every scheduled execution and resulting file modification in an auditable log.
• Restrict the task to the minimum required workspace paths.

T06 · System Persistence

Error

• Location: crons/active/weekly-review.md:1

Finding

Permanent Weekly Review Hook Execution

Content

View full analysis

Vulnerability Details

File Location: crons/active/weekly-review.md, lines 1-15
Vulnerability Type: Persistent scheduled hook execution
Risk Level: High

Vulnerable Code

yaml

---
name: weekly-review
type: permanent
schedule: "30 3 * * 1"
schedule_ist: "09:00 IST every Monday"
timezone: Asia/Kolkata
purpose: Weekly analytics review, funnel balance check, calendar health, growth journal
fire_once: false
auto_delete: false
status: active
---
# Weekly Review Cron — Permanent
Fires every Monday at 09:00 IST.
Execute hooks/weekly-review.md in full.
THIS FILE MUST NEVER BE DELETED.

Technical Analysis

This cron definition creates an active and unbounded weekly execution channel. Unlike a task containing all behavior locally, it delegates execution to hooks/weekly-review.md. That hook compiles platform metrics, analyzes funnel and content-pillar balance, writes a weekly analytics report, updates GROWTH_JOURNAL.md, updates persistent soul sections, and appends to the session log.

The scheduler metadata prevents one-shot retirement and automatic deletion, while the final instruction directs the Agent never to remove the persistence definition. Because the scheduled file invokes another file “in full,” later modifications to that hook could alter the effective recurring behavior without changing this cron entry.

No evidence shows remote payload retrieval, executable script invocation, operating-system cron modification, or command execution. The vulnerability is confined to persistent Skill-level scheduled hook execution.

Attack Path

1. A compatible Agent runtime loads the Skill and scans crons/active/.
2. The runtime registers the active Monday schedule.
3. At the scheduled time, the task executes hooks/weekly-review.md in full.
4. The hook reads platform, funnel, calendar, hashtag, and analytics state.
5. It writes weekly reports, updates the growth journal and ...[truncated 877 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic registration when the Skill is loaded.
• Require explicit owner consent that identifies the delegated hook and every file it may read or modify.
• Replace permanent recurrence with an expiring schedule or finite execution count.
• Remove THIS FILE MUST NEVER BE DELETED and expose immediate cancellation controls.
• Pin or integrity-check the invoked hook so its behavior cannot change silently after schedule approval.
• Require renewed approval if hooks/weekly-review.md changes.
• Constrain scheduled writes to an allowlist of task-specific files.
• Maintain an execution log recording trigger time, hook version, inputs, outputs, and modified paths.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (32)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SOUL.md (reported line 17)May include surrounding context.

md

---

## [PLATFORM PRESENCE]
<!-- One entry per active platform. Upsert. -->
<!-- Format: PLATFORM | FOLLOWERS | FOLLOWING | POSTS | AVG_ENGAGEMENT% | LAST_POST -->

---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SOUL.md (reported line 23)May include surrounding context.

md

---

## [CONTENT PIPELINE]
<!-- Current content pipeline summary. Update daily. -->
<!-- Format: ideas:N | drafts:N | review:N | approved:N | scheduled:N | published_this_week:N -->

---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SOUL.md (reported line 35)May include surrounding context.

md

---

## [FUNNEL HEALTH]
<!-- Current funnel balance. Update weekly. -->
<!-- Format: AWARENESS:N% | CONSIDERATION:N% | CONVERSION:N% | RETENTION:N% | ADVOCACY:N% -->

---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SOUL.md (reported line 59)May include surrounding context.

md

---

## [HASHTAG PERFORMANCE]
<!-- Top and bottom performing hashtag sets. -->
<!-- Format: SET_NAME | AVG_REACH | TREND | LAST_REVIEWED -->

---

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · brand/guidelines/dos-donts.md (reported line 8)May include surrounding context.

md

| Rule | Reason |
|---|---|
| Always credit sources for data/stats | Trust |
| Always respond to direct questions in comments | Community |
| Always use brand hashtag set on every post | Discovery |
| Always include one clear CTA per post | Conversion |
| Always proofread for typos before approving | Quality |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · brand/hashtags/master.md (reported line 35)May include surrounding context.

md

- #tag

## Always-On Brand Hashtags
<!-- Used on every post -->
- #[brand-hashtag]

## Campaign Hashtags

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/advocacy/strategy.md (reported line 8)May include surrounding context.

md

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/awareness/strategy.md (reported line 8)May include surrounding context.

md

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/consideration/strategy.md (reported line 8)May include surrounding context.

md

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/conversion/strategy.md (reported line 8)May include surrounding context.

md

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/retention/strategy.md (reported line 8)May include surrounding context.

md

# Funnel Stage: retention

## Goal
<!-- What this stage achieves in the customer journey -->

## Target Audience Mindset
<!-- What the person at this stage is thinking/feeling -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/advocacy/strategy.md (reported line 14)May include surrounding context.

md

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/awareness/strategy.md (reported line 14)May include surrounding context.

md

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/consideration/strategy.md (reported line 14)May include surrounding context.

md

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/conversion/strategy.md (reported line 14)May include surrounding context.

md

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · funnels/retention/strategy.md (reported line 14)May include surrounding context.

md

<!-- What the person at this stage is thinking/feeling -->

## Content Approach
<!-- How to create content for this stage -->

## Best Performing Content Types
<!-- Which formats and topics work here -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/content.md (reported line 53)May include surrounding context.

md

- Rejection reason: [if rejected]

## Performance
<!-- Filled post-publish -->
### 1-Hour
- Reach: | Likes: | Comments: | Saves: | Shares:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The rule activates on very broad, ordinary phrases related to content creation and instructs the agent to immediately write files, which can cause unintended skill invocation and persistence from casual conversation. In a multi-purpose assistant context, this increases the chance of misinterpreting brainstorming or offhand remarks as commands, leading to unwanted state changes and content creation without explicit user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly maintains folders for engagement comments, direct messages, mentions, audience segments, personas, and competitor analysis, but the top-level description does not warn that it processes and stores potentially sensitive communications and profiling data. This creates a transparency and privacy risk: users may enable or use the skill without understanding that private or personal data will be retained in the workspace, increasing the chance of inappropriate collection, over-retention, or accidental exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says the hook 'Fires when owner mentions a content idea' but does not disclose that it will immediately create a draft entry and update the pipeline. This hidden side effect undermines informed consent and increases the risk of silent, unintended modifications to user content management state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger is broad enough to fire on casual conversation and uses an open-ended catch-all ('or similar'), which can cause unintended activation and automatic state changes. In this skill, that means creating persistent draft entries and modifying the content pipeline without a clearly bounded user intent signal.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says the hook "Fires when content is published," but it does not define what event counts as publishing, who triggers it, or any exclusions. In a manifest-style markdown header, this is an ambiguous activation condition that could cause the skill to run in unintended publishing-related contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file instructs the skill to move files between review folders, log rejection reasons, and 'Apply changes immediately' on edit, but it provides no warning about altering stored content or review state. For markdown files, safety-relevant behaviors that affect user data or system integrity should be disclosed explicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The hook instructs the agent to write a weekly analytics report into the repository automatically, but it does not disclose or gate that repository modification with an explicit user warning or confirmation step. In an automated hook context, silent writes can surprise users, overwrite expected content, and create an integrity risk if the hook runs on a schedule without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The later steps direct the agent to update additional files such as GROWTH_JOURNAL.md and "Soul" state automatically, again without clear disclosure of write behavior or limits on what may be modified. Because these are broad update instructions in a scheduled hook, they increase the chance of unintended repository changes, state corruption, or hidden persistence of generated content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.