Dfw Content Calendar

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:26 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says, with ordinary LLM/API and CSV-export risks users should understand before use.

Install only if you are comfortable using Anthropic or a local LLM for your marketing prompts. Avoid putting confidential customer or business secrets in the niche or audience fields, pin dependencies if you maintain this skill, and review or sanitize CSV output before opening it in spreadsheet tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-23
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

yaml

install:
  - kind: uv
    package: anthropic
    bins: []

Technical Analysis

The installation manifest requests the anthropic package without an exact version constraint, lockfile, or integrity hash. Consequently, different installations can resolve to different package versions, including newly published versions that have not been reviewed with this Skill.

Installing a Python package can execute package build or installation logic and makes the package's runtime code trusted by the Skill. If the package, one of its transitive dependencies, or the configured package index is compromised, malicious code could execute during installation or when generate_calendar.py imports and uses the package.

The code also conditionally imports openai for its local backend, but the installation metadata does not explicitly declare and pin that dependency. This creates an incomplete and non-reproducible dependency specification.

Attack Path

1. An attacker compromises a future anthropic release, a transitive dependency, or the package distribution infrastructure.
2. The attacker publishes or serves a malicious version that still satisfies the unconstrained package request.
3. A user installs the Skill after the malicious version becomes available.
4. uv resolves and installs the attacker-controlled package content.
5. Malicious code executes during package installation or when the Skill imports and invokes the dependency.

Impact Assessment

Successful exploitation would execute code with the privileges of the user installing or running the Skill. Depending on those privileges, the malicious dependency could read accessible files and environment variables, including API credentials, modify user-owned files, make arbitrary network reques ...[truncated 222 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact reviewed version, for example anthropic==X.Y.Z.
2. Maintain a lockfile that records all transitive dependency versions.
3. Require cryptographic hashes for downloaded distributions where the installation framework supports them.
4. Restrict dependency retrieval to a trusted package index and prefer reviewed wheel artifacts.
5. Explicitly declare and pin the conditionally imported openai package if the local backend remains supported.
6. Add automated dependency vulnerability and provenance scanning to the release process.
7. Review dependency updates before changing pins rather than automatically accepting the newest release.

T09 · Insecure Skill Coding Practices

Warning

• Location: generate_calendar.py:339

Finding

Spreadsheet Formula Injection in CSV Export

Content

View full analysis

Vulnerability Details

File Location: generate_calendar.py:339-352
Vulnerability Type: CSV formula injection
Risk Level: Medium

Vulnerable Code:

python

def format_csv(cal: dict) -> str:
    output = io.StringIO()
    writer = csv.writer(output)
    writer.writerow(["day", "weekday", "platform", "content_type", "hook", "hook_b", "body", "cta", "hashtags", "char_count"])
    for week in cal.get("weeks", []):
        for post in week.get("posts", []):
            writer.writerow([
                post.get("day", ""), post.get("weekday", ""), post.get("platform", ""),
                post.get("content_type", ""), post.get("hook", ""), post.get("hook_b") or "",
                post.get("body", ""), post.get("cta", ""),
                " ".join(post.get("hashtags", [])), post.get("char_count", 0)
            ])
    return output.getvalue()

Technical Analysis

Calendar fields generated by a local or remote language model are written directly into CSV cells without neutralizing spreadsheet formula prefixes. The Python CSV writer correctly quotes and escapes CSV syntax, but quoting does not prevent spreadsheet applications from interpreting a cell beginning with =, +, -, or @ as a formula. Leading tab or carriage-return characters can also be used to bypass simplistic prefix checks in some spreadsheet applications.

Model output is not inherently trusted. A malicious instruction embedded in user-supplied niche or audience text, a compromised model endpoint, or unexpected model behavior could produce a formula-prefixed hook, body, CTA, hashtag, or other field. The documentation explicitly promotes importing the generated CSV into tools such as Notion, Buffer, Hootsuite, and spreadsheet-based review workflows, making downstream interpretation foreseeable.

Attack Path

1. An attacker supplies crafted niche or audience content intended to influence model output, or compromises the ...[truncated 1204 chars]

Remediation

View remediation

Remediation Suggestions

1. Introduce a dedicated CSV-cell sanitization function for all model-controlled fields.
2. After accounting for leading whitespace and control characters, neutralize values beginning with =, +, -, @, tab, or carriage return. A common defensive approach is to prefix the value with an apostrophe, subject to compatibility testing with supported import targets.
3. Apply sanitization to hooks, alternate hooks, bodies, CTAs, hashtags, content types, platform values, and any future text fields.
4. Preserve an unsanitized JSON export only if consumers require raw content, while clearly documenting that CSV output is spreadsheet-safe and may contain defensive prefixes.
5. Add regression tests covering each dangerous prefix, leading whitespace, control-character bypasses, and quoted formulas.
6. Validate model output against the expected schema and enforce reasonable string types and lengths before any export.
7. Warn users that generated content should be reviewed before importing it into applications capable of evaluating formulas.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documentation explicitly says the demo mode needs no API key and later says generation uses 'Local MLX first (free, unlimited), Haiku fallback.' However, the manifest metadata declares ANTHROPIC_API_KEY under required environment variables and marks it as the primary environment. This is an intent-level contradiction between the documented execution model and the declared runtime requirements.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · generate_calendar.py (reported line 171)May include surrounding context.

python

else:
        try:
            import openai, urllib.request
            urllib.request.urlopen("http://localhost:8800/health", timeout=1)
            return openai.OpenAI(base_url="http://localhost:8800/v1", api_key="local"), "local"
        except Exception:
            import anthropic

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When local detection fails, the script silently falls back to Anthropic and sends user-supplied niche/audience content to a third-party service. This is a genuine privacy/security issue because the transfer happens without explicit runtime consent or a clear warning at the decision point, so users may disclose sensitive business, marketing, or customer-context data unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.