Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `patrones-visuales.md` — Librería de componentes visuales reutilizables (mockups, accordion, decision matrix, etc.)
Security audit
generador-artifact-educativo-formula100k
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Spanish educational HTML-generator workflow, with some external-delivery and CDN dependency considerations but no artifact-backed malicious behavior.
Install only if you are comfortable using this in a Telegram-based workflow and sending the generated educational HTML back through Telegram. Do not provide confidential student data, private business material, or copyrighted course text unless you are authorized to include it in the generated artifact. Expect the produced HTML to require internet access for CDN libraries unless the template is changed to bundle dependencies locally.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `patrones-visuales.md` — Librería de componentes visuales reutilizables (mockups, accordion, decision matrix, etc.)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `patrones-visuales.md` — Librería de componentes visuales reutilizables (mockups, accordion, decision matrix, etc.)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest says the skill saves the generated file to a specific directory and sends it via Telegram, but this file contains only client-side UI code for the artifact itself. There is no code here for filesystem output or Telegram delivery, so the documented behavior is not reflected in the actual implementation shown.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly says generated artifacts should be sent by Telegram, but it does not require confirming that the generated file is safe to transmit or warning the user that source-derived content may leave the local environment. If the source material contains proprietary course content, student data, or sensitive business information, the agent could exfiltrate that content to a third-party messaging platform without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow repeats the instruction to send the completed HTML by Telegram as a document after validating it, again without any privacy notice, destination confirmation, or data-classification step. In context, the skill processes user-supplied educational source files, so the generated artifact can reproduce sensitive or proprietary content and be transmitted externally by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates a specific language variant ('español neutro') and forbids another valid regional form ('voseo argentino') as a strict rule. This is a natural-language policy issue because it forces a locale/style choice without indicating user opt-in or a necessary region-specific compliance reason.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L498 states that texts that teach something 'van escritos de verdad en español', which is a natural-language requirement forcing Spanish. This is a locale/language policy concern because the file does not offer opt-in, alternatives, or a documented region-specific reason for restricting content to Spanish.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The HTML root element sets
lang="es", and the entire UI text is written in Spanish, which establishes a fixed language choice for the skill template. The file does not indicate that users may opt into another language or that the Spanish-only behavior is required for a region-specific purpose.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template is not actually self-contained because it loads React, ReactDOM, Babel, and Tailwind from third-party CDNs at runtime. This creates supply-chain and availability risk: if a CDN is compromised, blocked, or unavailable, the artifact may execute untrusted code or fail to function despite claims that it works offline by double-clicking.
- Content