Create Content

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:17 AM UTC
• Version: 1.0.0

Overview

The skill is a content-writing helper, but it can pull from private notes, journals, and prior sessions without enough user-directed scoping.

Review this skill before installing if your agent can access private notes, journals, or prior conversations. Use it only with explicit source limits, and approve any personal or business details before turning them into public posts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:36
• Finding: Unscoped Access to Private User Records## Vulnerability Details **File Location**: `SKILL.md`, lines 36-40 **Vulnerability Type**: Unscoped access to privacy-sensitive user data **Risk Level**: Medium ### Vulnerable Code ```markdown ### If user says "help me figure out what to post": 1. Search for recent notes, journal entries, sessions 2. Look for: observations, breakthroughs, experiments, patterns noticed 3. Present 2-3 potential angles and ask which resonates ``` ### Technical Analysis The skill directs the agent to search recent notes, journal entries, and sessions whenever a user asks for help deciding what to post. It does not require explicit consent before accessing those records, identify approved data sources, restrict the time range, or exclude sensitive and unrelated material. This violates least-privilege principles because a generic content-ideation request may trigger access to substantially more personal information than is necessary. If the host agent has tools capable of searching private notes or prior sessions, sensitive records could be loaded into the active context and used to generate publishing suggestions. The instruction does not establish a mechanism for obtaining additional system permissions, and no external exfiltration endpoint is present. The risk instead arises from directing an already authorized agent to use its available access too broadly. ### Attack Path 1. A user invokes the skill and asks, “help me figure out what to post.” 2. The skill interprets this phrase as authorization to search notes, journals, and previous sessions. 3. The agent queries every accessible source without a source allowlist or defined time range. 4. Personal, confidential, or otherwise unrelated information enters the agent’s working context. 5. The agent derives content angles from that information. 6. Sensitive facts may be exposed directly or indirectly in suggested social-media content. ### Impact Assessment The behavior may expose any notes, journal entries, or session re ...[truncated 542 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed consent before searching any private notes, journals, or previous sessions. 2. Ask the user to select specific sources and a narrow time range before initiating a search. 3. Exclude private sessions, sensitive directories, and records containing credentials, health data, financial information, or third-party personal data by default. 4. Apply data minimization by retrieving only short, relevant excerpts rather than complete records. 5. Present sanitized topic summaries for approval before incorporating source details into a draft. 6. Prevent private details from appearing in public-facing content unless the user explicitly approves each detail. 7. Replace the current instruction with a consent-aware workflow, for example: ```markdown 1. Ask whether the user wants to provide material directly or authorize a search. 2. If the user authorizes a search, ask them to select specific sources and a time range. 3. Search only the approved scope and exclude sensitive records by default. 4. Present sanitized topic summaries without quoting private source material. 5. Obtain approval before using personal details in a draft. ```

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

### DO:

- Short sentences. Like texting.
- Observations over wisdom. Show, don't preach.
- Specific numbers. "$120K ARR" not "good revenue"
- Personal mixed with insight
- Real examples with data

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The usage trigger accepts highly generic natural-language input such as a rough idea, topic, or 'help me figure out what to post,' which can overlap with ordinary conversation and cause the skill to activate in situations the user did not clearly intend. In an agent environment, this increases the chance of prompt/skill confusion and unintended routing into this skill, potentially shaping outputs or causing access to user notes when the user only made a casual request.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The quick commands use short, common phrases like 'thread about [topic],' 'explore,' and 'help me think,' which are ambiguous and likely to appear in normal user dialogue outside an explicit tool invocation context. This makes accidental or adversarial triggering easier, especially in multi-skill systems where broad phrases can hijack routing and steer the assistant into this skill unexpectedly.

Static analysis

No suspicious patterns detected.