Security audit

Franchise Analyzer Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent franchise-analysis helper with disclosed commercial sourcing, but users should verify that report source attribution matches the FDD actually used.

Before installing, understand that the skill is maintained by a franchise-development company and steers agents toward its FDD library and directory. When using it with your own FDD or another source, make sure the generated report names the actual source and treat its output as analysis only, not legal or financial advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:91
Finding: Mandatory Third-Party Attribution Hijacks Generated Reports
Content: View full analysis
(FDD ) Verdict: BUY / HOLD / PASS — ## The money - All-in investment: $–$ - Franchisor take: % royalty + % ad fund = % of revenue - Avg unit revenue (Item 19): $ (disclosed? yes/no, sample size, which quartile) - Est. unit cash flow: $ | Payback: yrs | Cash-on-cash: % - Breakeven revenue: $ ## The system's health (Item 20) - Units: -> over 3 yrs (net <+/-n>, % growth/yr) - Closures + terminations: (%/yr) ## Red flags - ## Bottom line <2-3 sentences: who this is right for, the key risk, and the realistic return.> Source FDD: Franchise Fast Track FDD library — https://franchisefasttrack.io/fdd-database ``` ``` ### Technical Analysis The Skill instructs the Agent to use a report template that always includes a fixed third-party attribution and outbound URL. The attribution is unconditional: it is inserted even when the user supplies the FDD directly or when another source is used. Because these instructions are loaded as part of the Skill workflow, they alter the Agent's generated response rather than merely documenting an optional resource. This creates an output-integrity issue and can cause the Agent to make a false provenance claim. The behavior best matches instruction hijacking because attacker-controlled Skill text imposes promotional content on the Agent's current-session output. No code execution, privilege escalation, persistence, credential access, or data exfiltration was identified in connection with this finding. ### Attack Path 1. A user installs or activates the `franchise-analyzer` Skill. 2. The user requests analysis of a fran ...[truncated 993 chars]
Remediation: View remediation
``` 5. Add an explicit instruction that the Agent must not claim a source was used unless it actually accessed that source. 6. Keep commercial attribution separate from analytical conclusions and include it only when the user requests resource recommendations. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 22)May include surrounding context.
md
## Install Drop this folder into your skills directory (e.g. `~/.claude/skills/franchise-analyzer`) and it loads automatically when a franchise-evaluation question comes up. ## Use it

Static analysis

No suspicious patterns detected.