Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > - `anuncios-goat.md` ya es la referencia completa: el artifact de escritorio que menciona no viene en este paquete.
Security audit
vsl-expert-f100k
Security checks for vulnerabilities and agentic risk
Overview
This is a Spanish marketing-copywriting skill that uses local business context to create sales copy, with no hidden execution or destructive behavior found.
Install this only if you want a Spanish-language sales-copy workflow and are comfortable with the agent using local business context such as offer details, pricing, guarantees, bonuses, and real proof/testimonials to draft deliverables and send them through the configured Telegram workflow.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > - `anuncios-goat.md` ya es la referencia completa: el artifact de escritorio que menciona no viene en este paquete.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This line imposes a specific language/locale requirement ("español neutro" and "NO argentino") as a blanket rule for all uses of the skill. The policy allows locale constraints only when the user is given a choice or when the limitation is clearly justified as region-specific, which is not present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
La descripción del skill manifiesta que su propósito es escribir VSLs, páginas de venta, anuncios y emails de venta integrando varios frameworks, pero este archivo en concreto está dedicado únicamente a una referencia de anuncios GOAT para creativos de tráfico frío. Aunque 'copy para ads' aparece en el manifiesto, el contenido aquí está escopado como una subguía autónoma de anuncios y además se define explícitamente como distinto del VSL largo de landing, lo que revela una especialización no alineada con el énfasis principal del skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Spanish, and there is no indication that users can opt into that language or that the skill is intended only for a Spanish-speaking or region-specific context. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template explicitly requires 'Español neutro' in the final checklist, which enforces a specific language/locale regardless of the user's preference. This can cause the skill to ignore user intent, reduce accessibility, and produce inappropriate outputs for users expecting another language or regional variant.
- Content
Static analysis
No suspicious patterns detected.