Security audit

Kids Creator

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent workshop purpose, but it handles and publishes children’s identifiable content with insufficient privacy controls.

Review this skill before installing or operating it with real children. Require guardian/operator consent, minimize and pseudonymize stored data, avoid raw prompts in public displays, set deletion and revocation rules, protect gallery/game links, pin deployment dependencies, and replace broad Git staging with reviewed allowlisted files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:95
Finding: Plaintext Storage and Publication Workflow for Identifiable Data Belonging to Minors
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:357
Finding: Indiscriminate Repository Staging Can Commit Sensitive or Unintended Files
Content: View full analysis
Remediation: View remediation
/` files and reviewed index files. 2. Define a restrictive `.gitignore` covering `.env*`, credentials, runtime state, transcripts, logs, temporary files, and local configuration. 3. Run `git status --short` and inspect the staged diff before every commit. 4. Add automated secret scanning and personal-data checks as mandatory pre-commit and CI gates. 5. Reject commits containing Telegram identifiers, state JSON, access tokens, or unauthorized names and prompts. 6. Use a dedicated clean build checkout for deployment rather than a long-lived working directory. 7. Give deployment credentials only the minimum permissions required and rotate them immediately if they enter Git history. 8. Require explicit operator confirmation before pushing and deploying child-specific content. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:358
Finding: Unpinned npx and CDN Dependencies Permit Supply-Chain Substitution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill stores identifiable child session data keyed by telegramUserId, along with names, prompts, generated content, URLs, and timestamps, but presents no user-facing notice, consent, retention policy, or minimization controls. Because the subjects are pediatric patients, the context makes this significantly more sensitive and raises privacy and safeguarding concerns beyond ordinary telemetry.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The voice-input flow sends children’s audio to external transcription services without any visible disclosure that audio leaves the device/session for processing. Audio from child hospital participants may contain names, health context, or other sensitive information, so silent third-party transmission creates a substantial privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill plans to distribute game URLs, gallery links, and QR codes tied to individual children’s creations without clearly explaining exposure boundaries or access controls. Even if the content seems innocuous, child-associated public links can enable unintended sharing, profiling, or discovery of participation in a sensitive setting.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow explicitly stores free-form child inputs and generated outputs for later reuse, which creates a retention risk because these fields may contain personal details or sensitive disclosures. In a workshop with minors in a medical setting, preserving raw natural-language content is more dangerous than in a generic creative app.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Preserving the child’s first input and first result for later display introduces a disclosure path for whatever the child initially said or generated, including accidental personal or sensitive content. Because the program also uses public or semi-public display moments, this increases the chance of unintended exposure to peers, staff, or guardians.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs individualized outputs to be broadcast on a large screen and shared via gallery URLs and QR codes, which effectively exposes child-associated content beyond the immediate session. In a pediatric hospital environment, public display and persistent external links materially heighten privacy, dignity, and safeguarding risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is framed as a child-facing workshop assistant, but it also contains repository mutation and Cloudflare deployment instructions that extend its authority into source control and public hosting. This materially increases risk because a conversational workflow handling children’s content could also publish files, modify site content, or push unintended data to a public endpoint.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The deployment step invokes npx wrangler without pinning an exact package version, which can cause execution of an unexpected or newly published version during deployment. In a workflow that also holds Cloudflare credentials and performs publishing, a supply-chain compromise or breaking change could lead to unauthorized deployment actions or credential exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.