creadora-comunidades-skool

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 4:34 PM UTC
• Version: 1.0.1

Overview

This skill is a Spanish Skool-community copywriting and proposal generator with disclosed, purpose-aligned local document creation.

Install this if you want a Spanish-focused assistant for building Skool community assets and proposal documents. Review the Telegram workflow and output path expectations before using it with confidential client data, and use --out if you need the document saved somewhere other than the script's default Downloads location.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Ae1

High

• Category: analysis-evasion

Content

> - El `.docx` de la propuesta usa `build_docx.py` y necesita `python-docx`. Si no está, entrega la propuesta en `.md` y dilo.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

5. **Generar:** usar la plantilla correspondiente de [templates.md](templates.md)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

5. **Generar:** usar la plantilla correspondiente de [templates.md](templates.md)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: En un archivo markdown, los disparadores deben ser específicos para evitar invocaciones no deseadas. La frase "any copy or structure for a Skool community" abarca una gama muy amplia de solicitudes y no delimita claramente qué tipos de peticiones sí o no activan la skill, lo que puede solaparse con tareas generales de redacción o estrategia.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: La instrucción "Siempre trabaja en español" fija una política lingüística obligatoria. Según la política aplicable, forzar un idioma concreto sin opción de elección u opt-in del usuario constituye una violación de política de lenguaje o locale.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: La línea establece una restricción lingüística obligatoria y además excluye variantes regionales específicas. Eso impone una preferencia de idioma/locale sin ofrecer elección a la persona usuaria, lo que encaja en la categoría de violación de política natural-lingüística.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Line L020 requires 'español neutro segunda persona (tú)' and explicitly forbids Argentine variants such as 'vos/tenés/copiá/acá'. This is a natural-language locale policy constraint that forces one language variety without indicating user choice or a documented compliance need.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This JSON schema uses Spanish field names throughout, which imposes a specific language/locale on skill consumers without any visible indication that Spanish is optional or user-selected. Under the natural-language policy criteria, forcing a specific language without opt-in can be a policy violation.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: En una plantilla completamente en español, la instrucción "haz clic en \"JOIN NOW\" y entra" impone una etiqueta en inglés sin indicar opción de idioma o adaptación al contexto del usuario. Esto constituye una posible violación de política de idioma/locale porque no ofrece elección ni justificación para el cambio de idioma.

Static analysis

No suspicious patterns detected.