Security audit

Re Blog Writer

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed blog-writing skill that researches in a browser and saves a draft locally, with no evidence of hidden or malicious behavior.

Before installing, understand that this skill will use a managed browser for web research and save the finished post under ~/blogs. Check the target filename if you already have posts there, since the artifact does not spell out overwrite handling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The manifest says to use the skill when the user "provides a subject and wants a full, human-sounding blog post," which is a broad natural-language condition rather than a specific trigger or constrained context. Without explicit exclusions or narrower invocation criteria, this could match many ordinary writing requests and cause unintended activation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that it writes output to ~/blogs/<slug>.md without requiring explicit user acknowledgment that a local filesystem change will occur. In an agent setting, silent file creation in the home directory can surprise users, overwrite expected content patterns, or normalize unauthorized local writes if the skill is invoked automatically.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow explicitly instructs creating ~/blogs if it does not exist and saving a file there, again without an explicit safety prompt about local data changes. This increases risk because it not only writes content but also mutates directory structure, which is a persistent side effect that may occur without the user's clear consent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The instruction to 'use this file whenever drafting a comment, reply, or post' is overly broad and can cause the style guidance to be applied outside the specific blog-writing task. In an agent skill, broad activation conditions increase the chance of unintended behavior, including overriding user-preferred tone or affecting unrelated outputs without explicit consent.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The file imposes mandatory style rules such as banning specific words 'unconditionally' without any user opt-in, which can conflict with user intent and reduce transparency about how outputs are shaped. In a writing skill, hard-coded stylistic constraints can become a policy-manipulation issue when they silently override direct user preferences or broader assistant behavior.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: This is a natural-language policy issue because the file mandates a specific writing convention rather than offering it as an option. The rule applies broadly and does not indicate user choice or a justified locale-specific constraint.

Static analysis

No suspicious patterns detected.