Security audit

marketing

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent marketing assistant, but it needs Review because optional Notion and browser-plugin flows can persist or expose sensitive business and browsing data without clear confirmation boundaries.

Install only if users understand that marketing drafts, reports, budgets, metrics, competitor analysis, and visible browser content may be processed by connected tools. Require human confirmation before any Notion write, avoid sharing trade secrets or private account pages, and independently verify legal/compliance claims before publishing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill’s redline rules correctly forbid fabricated metrics, but the included example copy still uses unverified efficacy-style claims such as '28天用下来…明显退了' and '亲测有效'. In a marketing-copy skill, examples strongly shape downstream outputs, so contradictory examples can induce the model to generate misleading or non-compliant advertising claims despite the stated policy.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README states users can 'naturally trigger' the skill by simply expressing a need, which creates overly broad activation semantics. In an orchestration environment, this can cause unintended invocation of marketing functions on ambiguous prompts, leading to misrouting, unexpected data handling, or execution of the wrong sub-skill without clear user intent.

Vague Triggers

High

Confidence: 95% confidence
Finding: The manifest description embeds many broad trigger phrases such as generic requests for copywriting, campaigns, SEO, and analysis, which can cause the skill to activate on ordinary user requests without clear user intent to invoke this package. In an agent environment, this increases the chance of unintended routing, causing the model to follow this skill’s internal workflow and constraints when the user did not explicitly ask for it.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The routing logic matches a sub-skill whenever user input contains any listed keyword or mentioned scenario, and then chooses the 'highest match' without a strict disambiguation rule. This permissive matching can misroute benign requests into the wrong sub-skill, leading to unintended data handling, incorrect outputs, or execution of unnecessary downstream templates from the references directory.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises writing plans, budgets, and execution checklists into Notion without an explicit user-facing warning that generated content and possibly sensitive campaign data will be sent to an external third-party service. This can cause unintended data disclosure, especially when plans include budgets, customer segments, event logistics, contacts, or internal strategy, and the operational nature of the skill makes such data likely.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly enables writing competitor reports and feature matrices to Notion, but it does not warn users that these outputs may contain sensitive internal strategy, pricing, positioning, or comparative business data that would be transmitted to an external SaaS. In a competitive-tracking context, this omission is materially risky because the generated report may combine public competitor data with confidential internal analysis, increasing the chance of unintended disclosure.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill asks for 'our side' company information for competitive comparison without telling users to avoid secrets such as internal roadmap, margins, customer lists, unreleased strategy, or nonpublic product details. Because the skill's purpose is strategic competitor analysis, users are especially likely to provide sensitive context, which can then be retained, processed, or exported to third-party integrations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The file states that, if connected, Notion may be used to write generated content into the user's workspace, but it does not warn users about this side effect or require explicit confirmation before performing the write. In an agent context, silent external writes can cause unintended data modification, leakage of sensitive draft content, or confusion about where generated content is being stored.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly enables writing marketing reports and core metrics to Notion, which is an external persistence and sharing destination, but it does not clearly warn users that uploaded campaign data may be transmitted to and stored in a third-party system. Because this skill handles potentially sensitive business metrics such as spend, ROI, conversions, and strategy notes, silent externalization increases the risk of unintended data disclosure, over-retention, and broader internal access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill advertises writing optimization reports and full article content into Notion, which is an external third-party system, but does not require explicit user confirmation or warn that submitted content may be persisted outside the current session. This creates a real data-handling risk because users may provide drafts, internal strategy, or unpublished marketing materials without realizing they will be externally stored.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The SEO diagnosis mode instructs the agent to access a user-supplied website URL and analyze it, but does not clearly notify the user that this may trigger outbound network requests. While expected for the feature, the missing disclosure can still surprise users and may be problematic in restricted environments or when URLs contain internal or sensitive endpoints.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to install a browser plugin that can read platform webpages and capture screenshots, but it does not clearly warn that visible page content, account-contextual data, or user-provided screenshots may be transmitted to the agent for analysis. This creates a privacy and data-exposure risk, especially because social platforms may contain personalized feeds, private account state, or sensitive browsing context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill states that reports and topic databases can be written to Notion, but it does not clearly disclose that generated reports, trend data, and possibly user-provided business context will be transferred to and stored in a third-party service. Without a clear warning and consent boundary, users may unknowingly export internal marketing strategy or sensitive brand information to external storage.

Static analysis

No suspicious patterns detected.