Ai Company Ceo 2.0.0

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 2.0.1

Overview

This skill is a disclosed AI-company CEO/orchestration skill, but it asks for broad file, network, and cross-agent authority with loosely scoped delegation and mutable dependencies.

Review this skill before installing. It is not clearly malicious, but it should only run in a tightly sandboxed workspace with restricted file paths, approved API destinations, pinned dependency versions, and explicit approval before sending sensitive business, legal, financial, HR, or security context to other agents.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:71

Finding

Overly Broad File, Network, and Inter-Agent Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71-75
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: High

Vulnerable Configuration

yaml

permissions:
  files: [read, write]
  network: [api]
  commands: []
  mcp: [sessions_send, subagents]

Technical Analysis

The Skill requests unrestricted file read and write access, generic API network access, and the ability to send data to other sessions or delegate work to subagents. No path restrictions, API endpoint allowlist, permitted HTTP methods, data-classification controls, or per-operation approval requirements are defined.

These privileges are broader than necessary for many of the Skill's declared governance and report-generation activities. Although command execution is disabled, the combination of file reads, outbound API access, and inter-agent messaging creates a potential data-access and exfiltration channel.

A malicious user task, prompt injection embedded in business data, or compromised dependent Skill could cause the agent to read unrelated files and then disclose their contents through an API call, sessions_send, or a delegated subagent. File write access could also be used to overwrite or poison unrelated project records.

Attack Path

1. An attacker supplies a crafted task or places malicious instructions in data processed by the CEO Skill.
2. The Skill or one of its delegated agents interprets those instructions as part of the requested workflow.
3. The agent uses unrestricted file-read permission to access files outside the legitimate strategy or audit scope.
4. Sensitive content is transmitted through the unspecified API capability, sessions_send, or a subagent.
5. Alternatively, unrestricted write access is used to modify unrelated reports, configuration, or persistent knowledge records.
6. The resulting inter-agent delegation and audit output may make the unauthorized operation appear to be a legitimate CEO w ...[truncated 628 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict file reads and writes to dedicated directories, such as a Skill-specific report or audit workspace.
2. Separate read and write permissions and grant write access only when the requested workflow requires persistence.
3. Deny access to credentials, environment files, source-control metadata, user home directories, and unrelated project paths.
4. Replace generic API access with an explicit allowlist of trusted domains, endpoints, protocols, and HTTP methods.
5. Block the transmission of secrets and sensitive data using outbound data-loss-prevention controls.
6. Require explicit user or policy approval before sending sensitive context through sessions_send or delegating it to subagents.
7. Pass only the minimum task-specific context to each dependent agent.
8. Record destination, data classification, purpose, and authorization for every outbound API or inter-agent message.
9. Enforce these restrictions in the runtime sandbox rather than relying only on natural-language instructions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:76

Finding

Unpinned and Unverified Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76-91
Vulnerability Type: Mutable third-party Skill dependencies without version or integrity constraints
Risk Level: High

Vulnerable Configuration

yaml

dependencies:
  skills:
    - ai-company-hq
    - ai-company-cfo
    - ai-company-cmo
    - ai-company-cho
    - ai-company-cto
    - ai-company-cpo
    - ai-company-clo
    - ai-company-cqo
    - ai-company-ciso
    - ai-company-cro
    - ai-company-kb
    - ai-company-registry
    - ai-company-audit
    - ai-company-conflict

Technical Analysis

The Skill declares fourteen external Skill dependencies using names alone. It does not pin exact versions, specify integrity hashes, identify trusted publishers, or constrain resolution to an authenticated registry.

Name-only dependency resolution is mutable. A dependency can therefore change after this Skill has been reviewed, or a resolver could select an unintended component with the same or a confusingly similar identity. This is especially significant because the parent Skill has file, network, and inter-agent permissions and explicitly delegates work through sessions_send and subagents.

No evidence establishes that any listed dependency is currently malicious. The vulnerability is the absence of controls that ensure the reviewed dependency is the same component executed later.

Attack Path

1. An attacker compromises a dependency publisher or introduces a malicious release under a dependency name.
2. Alternatively, dependency resolution is redirected to an untrusted registry or unintended package identity.
3. Because no version or digest is pinned, installation or invocation resolves the altered dependency.
4. The CEO Skill delegates business context or operations to the dependency through inter-agent tooling.
5. The malicious dependency abuses the received context or available runtime capabilities to access data, alter output, or send information externally.
6. Subseq ...[truncated 736 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every Skill dependency to an exact, immutable version.
2. Record and verify a cryptographic digest or signed manifest for each dependency.
3. Resolve dependencies exclusively through an authenticated, approved registry.
4. Validate publisher identity and require signed releases.
5. Maintain a lockfile containing the complete resolved dependency graph and integrity metadata.
6. Prevent automatic dependency upgrades in production.
7. Re-audit dependencies before approving any version or digest change.
8. Apply independent least-privilege permissions to each dependency rather than inheriting the parent Skill's access.
9. Limit delegated data to the minimum required fields and redact secrets or sensitive information.
10. Add continuous monitoring for dependency ownership changes, revoked signatures, unexpected releases, and integrity mismatches.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list contains broad, generic business and AI terms that can match many unrelated user requests, causing the skill to activate outside its intended scope. In a skill with file read/write, network API access, and subagent/session capabilities, unintended invocation increases the chance of over-broad orchestration, inappropriate delegation, or unsafe actions being proposed or taken in irrelevant contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation scenarios enumerate many generic organizational and engineering topics, making the scope ambiguous and prone to accidental routing. Because the skill is designed as a high-authority orchestrator with cross-agent coordination semantics, accidental invocation can steer conversations into this skill's rigid governance flow and potentially trigger inappropriate access patterns or unsafe business decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The communication rules mandate a fixed presentation style, including prioritizing Markdown tables and a specific terse response style, without indicating user choice. While not a regional locale issue, this is a natural-language policy concern because the skill constrains response format and style unconditionally rather than offering user preference or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.