Security audit

Google Reviews Pain Detector

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but users should treat its optional save mode as a real write to a local business lead list.

Install only if you are comfortable with this skill scraping third-party review sites and reading your local Master Lead List. Avoid --save unless you want it to append automatically generated HOT lead rows to /Users/wlc-studio/StudioBrain/30_INTERNAL/WLC-Services/LEADS/MASTER_LEAD_LIST.md; consider backing up that file first because the script has no confirmation prompt or rollback.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

Category: analysis-evasion
Content: | `SKILL.md` | This file |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation advertises a `--save` mode that appends HOT leads back to the Master Lead List, but it does not clearly warn that this operation modifies persistent user data. That can lead users to run the command expecting a read-only scan and unintentionally alter or contaminate a source-of-truth lead list, especially in batch mode.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The top-level docstring says the tool scans Google/Yelp reviews, and the CLI description says 'Google Reviews Pain Detector,' which frames the skill as a review scanner. However, the implementation also extracts and follows links to other review platforms such as BBB, Trustpilot, Angi, HomeAdvisor, Birdeye, and reviews.io, expanding beyond the stated sources. This is an active documentation mismatch about the scope of data sources used.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The code can modify a hard-coded master lead list on disk when invoked with --save, appending automatically generated HOT leads based on scraped content. This is risky because it performs persistent local data mutation without an explicit confirmation step, dry-run default, or prominent warning, which can corrupt internal business records or introduce low-quality/duplicated entries at scale.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The module docstring frames detected businesses specifically as leads for "Gracie AI Receptionist," and later output reinforces that pitch direction. This imposes a fixed organizational/commercial framing in natural language rather than presenting results neutrally or allowing the user to choose the downstream use.

Static analysis

No suspicious patterns detected.