Security audit

blog-writer

Security checks for vulnerabilities and agentic risk

Overview

This writing skill is review-worthy because it requires sending drafts to a fixed Notion database and includes a pruning script that can delete files outside its intended folder.

Install only if you intend drafts to be written to the specified TS Notes Notion database and are comfortable with finalized posts being retained for future style examples. Before use, change the Notion destination to your own approved database, require explicit confirmation before every publish, and fix or avoid manage_examples.py pruning until its path is constrained to the skill directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:56
Finding: Mandatory publication of user content to a fixed third-party Notion workspace
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: manage_examples.py:11
Finding: Example-pruning path escapes the project directory and can delete unrelated files
Content: View full analysis
MAX_EXAMPLES: print(f"⚠️ Library exceeds limit by {count - MAX_EXAMPLES} files") print(f"Recommend removing the {PRUNE_COUNT} oldest examples:") print() for i, (date, name) in enumerate(examples[:PRUNE_COUNT]): print(f" {i+1}. {name} ({date.strftime('%B %d, %Y')})") else: print(f"✓ Library is within limits ({MAX_EXAMPLES - count} slots available)") print() print("All examples (oldest first):") print("-" * 40) for date, name in examples: print(f" {name}") def prune_oldest(dry_run=True): """Remove the oldest examples to bring library under limit.""" examples = list_examples() count = len(examples) if count <= MAX_EXAMPLES: print("Library is within limits. No pruning needed.") return to_remove = examples[:PRUNE_CO ...[truncated 2772 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill creates long-form content in a specific authorial voice and manages the workflow through publication. The supplied code does none of that. Its actual purpose is maintenance of a local examples library, including listing markdown examples by date and optionally deleting old files. This is a materially different primary purpose and includes an undeclared destructive filesystem capability (pruning/deleting files). Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates automatic publication of draft content to Notion, including full post content, without requiring explicit user consent at the time of transfer or clearly warning that data will leave the local interaction context. That can expose confidential drafts, proprietary research, client information, or personal data to a third-party service unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill states finalized posts will be saved into a local examples library for future reuse, but this retention behavior is not prominently disclosed as a data persistence action with reuse implications. Storing user content for future style calibration can create privacy, confidentiality, and consent issues, especially if drafts contain sensitive or proprietary material.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
### Voice & Tone - **Direct and opinionated**: State positions clearly, even contrarian ones - **Conversational**: Write like speaking to a colleague—accessible without being simplistic - **First-person when sharing experience**: Use "I" naturally for personal insights - **Authentic skepticism**: Willing to criticize trends when warranted

Static analysis

No suspicious patterns detected.