Auto Body Collision Repair Kit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.1

Overview

This is a markdown prompt kit for Nevada-focused auto body marketing compliance, with no code execution, persistence, credential access, or hidden system changes.

Installers should treat this as a marketing prompt kit, not legal advice. It is most appropriate for Nevada and Las Vegas-area auto body shops; businesses in other jurisdictions should have local requirements reviewed before publishing generated copy.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The README presents Nevada statutes and compliance requirements as core gating logic for the skill without clearly scoping the content to Nevada or distinguishing federal rules from state-specific ones. Users outside Nevada could rely on legally inaccurate marketing guidance, creating compliance, consumer-protection, and misrepresentation risk if the skill is applied in other jurisdictions.

Scope Creep

Low

• Category: Excessive Agency

Content

## The Problem

Auto body marketing is built on claims that range from unsubstantiated to outright federal violations. "Eco-friendly paint" without EPA NESHAP compliance documentation. "I-CAR certified technicians" when certification expired two years ago. "100% OEM parts" on a car repaired with LKQ salvage components. "We handle everything with your insurance" when the shop is on a DRP network with negotiated rates that may not cover your actual damage.

Every AI marketing tool generates these violations. This skill blocks them and replaces them with accurate, legally-defensible claims that win the high-value customer — the one who Googles their options before handing over a $6,000 repair.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

## The Problem

Auto body marketing is built on claims that range from unsubstantiated to outright federal violations. "Eco-friendly paint" without EPA NESHAP compliance documentation. "I-CAR certified technicians" when certification expired two years ago. "100% OEM parts" on a car repaired with LKQ salvage components. "We handle everything with your insurance" when the shop is on a DRP network with negotiated rates that may not cover your actual damage.

Every AI marketing tool generates these violations. This skill blocks them and replaces them with accurate, legally-defensible claims that win the high-value customer — the one who Googles their options before handing over a $6,000 repair.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.