trial-reels-lab-f100k

• Outcome: Review
• Latest audit: Sep 17, 2026 · 5:20 PM UTC
• Version: 1.0.0

Overview

This skill is related to its stated Instagram trial-reel purpose, but it asks agents to make broad local environment changes and uses an undisclosed remote JavaScript dependency during local rendering.

Review before installing. This skill should only be used if you are comfortable with it installing Homebrew/npm tools, generating local HTML that contacts jsDelivr, and optionally creating Apple Reminders when that flag is used. Prefer manual approval for installs, local vendoring of GSAP, and using the OpenClaw-limited flow without `--recordatorios`.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Ae1

High

• Category: analysis-evasion

Content

> - Paso 7: corre `plan_publicacion.py` **sin** `--recordatorios` (no hay Apple Reminders). Los avisos de 48 h y del 25% se crean como automatización de OpenCla

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

> - Paso 7: corre `plan_publicacion.py` **sin** `--recordatorios` (no hay Apple Reminders). Los avisos de 48 h y del 25% se crean como automatización de OpenCla

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Leer **`matriz-variantes.md`** y llenar la matriz forzada. Cada variante ocupa una celda distinta; **no se permiten dos variantes de la misma celda** — si las 4

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Leer **`matriz-variantes.md`** y llenar la matriz forzada. Cada variante ocupa una celda distinta; **no se permiten dos variantes de la misma celda** — si las 4

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Leer **`matriz-variantes.md`** y llenar la matriz forzada. Cada variante ocupa una celda distinta; **no se permiten dos variantes de la misma celda** — si las 4

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest explicitly says "En este agente no compone el video ni publica," limiting the skill to producing overlays and a publication plan. However, the skill documentation describes generating final `VARIANTE_A.mp4` to `VARIANTE_D.mp4` by compositing overlays onto the base video and creating real reminders, which goes beyond the manifest's stated non-composition scope.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The top-level description states the agent does not compose video, yet later sections instruct running `render_variantes.py` to composite overlays over the original video and output ready-to-upload MP4 variants, and `plan_publicacion.py --recordatorios` to create actual reminders. This is an active contradiction within the skill's own documentation about what the agent does.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The onboarding block runs installation commands such as `brew install ffmpeg` and `npm install -g hyperframes` without requiring explicit user approval or warning that the local system will be modified. In an agent context, automatic package installation changes the host environment and can introduce both integrity risk and unintended persistence, especially when global packages are fetched from external registries.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs the agent to invoke `uvx mlx-whisper` without pinning a version or otherwise constraining the package source. That creates a supply-chain risk: future package changes or a compromised release could alter behavior at runtime and execute unreviewed code in the agent environment.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: La descripción del skill promete como salida los overlays PNG transparentes 1080×1920. Sin embargo, este archivo escribe `index.html` y `styles.css` por variante e incluso indica luego `hyperframes preview`, lo que muestra que aquí solo se preparan composiciones para un renderer externo y no se producen los PNG finales.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The generated HTML loads GSAP from a third-party CDN at runtime, creating a supply-chain and privacy risk: opening a local composition causes a network request and executes remote JavaScript in the browser context. If the CDN resource is compromised, changed, blocked, or replaced, preview/render behavior can be altered and untrusted code will run when the file is opened.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This is substantively the same issue as SDI-2: the generated document silently fetches and executes remote JavaScript from jsDelivr without warning. In a tool advertised around local asset generation, that hidden external dependency increases attack surface and may leak metadata such as IP address, user agent, and access timing.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill description says alerts should be via Telegram if approved and that the agent does not publish/act beyond planning, but this script can create real Apple Reminders when `--recordatorios` is used. That mismatch means the skill performs side effects on the host system not clearly declared in the manifest, which can surprise users, violate least-privilege expectations, and be abused to generate unwanted reminders or social-engineering prompts.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

end tell
    end tell
    '''
    cp = subprocess.run(["osascript", "-e", script],
                        capture_output=True, text=True)
    if cp.returncode != 0:
        print(f"⚠ No se pudo crear el recordatorio «{titulo}»: "

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: This markdown file contains user-facing instructions exclusively in Spanish, and there is no indication that the skill is region-specific or that users can opt into this language. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The HTML template sets <html lang="es"> unconditionally, which imposes a specific locale. Under the policy, forced language or locale settings should not be imposed unless the skill offers a choice or clearly documents why the locale restriction is required.

Static analysis

No suspicious patterns detected.