Content Creator Pro

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:20 AM UTC
• Version: 1.0.7

Overview

This is a local content-writing and performance-tracking skill with disclosed workspace writes and no evidence of network access, credential use, exfiltration, or destructive behavior.

Install only if you want an agent to create and queue marketing/social content, keep local performance records, and update audit/learning files. Review the generated posts before allowing any connected publishing skill to post publicly, and decide how long voice, performance, archive, and audit logs should be retained.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose presents the skill as a content-generation engine, while the described operational steps emphasize local file manipulation, analytics tracking, script copying, record rebuilding, and audit logging. This mismatch can mislead operators into granting trust and invoking the skill in broader contexts than intended, which is dangerous because deceptive or inaccurate capability descriptions are a common precursor to unsafe privilege use.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · voice.md (reported line 15)May include surrounding context.

md

Every sentence earns its place or it gets cut.
Write like you're talking to one smart person, not to a crowd.

<!-- Customize: describe your actual voice in 2-3 sentences -->

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README explicitly advertises persistent logging of posts, performance, viral alerts, weekly summaries, and voice creation events, but provides no data handling, retention, access control, or privacy notice. In an autonomous agent workflow, this can lead to silent accumulation of potentially sensitive content, behavioral metadata, and user-associated activity that could be exposed, misused, or retained longer than intended.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill declares filesystem access in metadata but does not define a clear tool/permission scope in the standardized form the analyzer expects. That creates ambiguity for the agent runtime and reviewers about what operations are actually authorized, increasing the chance of unintended read/write use beyond the user's expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest says to 'Use whenever the agent needs to write or queue content for any channel,' which is extremely broad and does not clearly bound when this skill should activate versus other writing-related skills. Although 'agent-shark-mindset signals' is mentioned earlier, the description still leaves activation scope ambiguous and provides no exclusion cases or negative examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill performs or instructs substantial automatic file creation and modification across multiple workspace locations, but the description does not prominently warn users about that behavior. This reduces informed consent and can lead users to invoke the skill without realizing it will mutate project state, create logs, or alter learning records.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructions tell the agent to verify Python and execute a copied script, expanding the skill from passive content/file handling into code execution. Even though the commands are simple, introducing interpreter execution increases attack surface because it allows behavior not covered by the declared low-risk content-writing role.

Content

No source excerpt is available for this finding.

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs writing a file into /workspace/content/scripts/, but that path is not listed in required_paths.write. Writing outside the declared scope undermines path-based containment and makes the metadata unreliable for sandboxing and review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The rebuild flow replaces data["posts"] with posts loaded from the library and then writes the result to performance.json. Although the command name suggests reconstruction, there is no confirmation prompt and the docstring/help text does not clearly warn that existing tracked post data will be overwritten.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatically creating a local voice.md file without warning or confirmation introduces an unauthorized state-changing side effect. Even if the intended content is benign, silent file creation can overwrite existing files, persist sensitive business context locally, or normalize broader unsafe write behavior by the agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The _usage field instructs the agent to write to this file automatically after every published post and to read it weekly, but it does not define any guardrails around when writes are allowed, what fields may be changed, or whether user approval is required. In an autonomous agent context, broad write triggers can lead to silent state changes, log poisoning, or persistence of untrusted/generated data that later influences agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file explicitly states that the agent writes to it automatically, but there is no user-facing warning, consent mechanism, or audit expectation described alongside that behavior. In a skill meant for autonomous content operations, silent automatic writes increase the risk of unexpected persistent changes, hidden telemetry accumulation, and downstream decisions being based on agent-modified state the user may not realize exists.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes a content creation engine that writes or queues content, but this guide also directs the agent to check for the existence of a local file and create it if missing. File creation may be implementation-related, but it is still an operational behavior not clearly reflected in the manifest's description of writing content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.