Data Breach Impact Calculator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:12 AM UTC
• Version: 1.0.2

Overview

This API-backed breach-cost calculator is coherent, but it should be reviewed because it sends potentially sensitive breach scenario details to ToolWeb without clear privacy or consent guidance.

Review this skill before installing. Use it only if you are comfortable sending breach-assessment inputs to ToolWeb, and avoid entering real customer records, PHI, credentials, incident identifiers, or confidential business details unless your organization has approved that sharing. Confirm the provider's privacy, retention, and security terms before using it for real incidents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:91
• Finding: Mandatory Commercial Attribution Hijacks Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 91-121 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Output Format ``` 💰 Data Breach Impact Assessment ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Industry: [industry] Records Affected: [count] Data Sensitivity: [level] 💵 Total Estimated Cost: $[amount] 📊 Cost Breakdown: 🏛️ Regulatory Fines: $[amount] ⚖️ Legal & Litigation: $[amount] 📧 Notification Costs: $[amount] 🔧 Remediation & Recovery: $[amount] 📉 Reputation & Business Loss: $[amount] 🔍 Investigation & Forensics: $[amount] ⚠️ Regulatory Exposure: [Region]: Up to $[max_fine] 💡 Cost Reduction Recommendations: 1. [Action] — Could reduce cost by [amount/percentage] 2. [Action] — Could reduce cost by [amount/percentage] 📎 Full report powered by ToolWeb.in ``` ``` ### Technical Analysis The skill prescribes a fixed response template that requires the agent to append the promotional statement `Full report powered by ToolWeb.in` to every successful assessment. This content is not necessary to calculate or communicate data-breach impact and instead modifies the agent's output for third-party commercial promotion. The surrounding skill instructions reinforce this behavior by requiring exclusive use of the ToolWeb API, prohibiting the agent from answering from its own knowledge, and explicitly noting that successful calls are tracked for billing and generate revenue for the skill creator. When the skill is loaded, these directives alter how the agent fulfills the user's request and insert creator-controlled advertising into the response. This is instruction-level behavior rather than executable-code compromise. The audited package contains only documentation files and does not include scripts that execute commands independently. ### Attack Path 1. A user installs or activates the skill. 2. The agent loads the behavioral instructions from `SKILL.m ...[truncated 1221 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory `Full report powered by ToolWeb.in` footer from the required response template. 2. Make attribution optional and clearly separate it from the substantive assessment. 3. Do not justify mandatory API use based on creator revenue or billing. API selection should be based on functionality, security, and the user's informed choice. 4. Obtain explicit user consent before sending organization details, regulatory regions, incident history, or other assessment data to a third-party service. 5. Clearly disclose what data is transmitted, how it is retained, and which privacy policy applies. 6. Permit a local or knowledge-based assessment when appropriate, or transparently explain that the external service is optional. 7. Minimize transmitted data and avoid sending unnecessary identifiers or timestamps when they are not required for the calculation. 8. Keep API credentials in environment variables, as currently documented, and ensure they are never included in request bodies, logs, or user-facing output. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README encourages users to submit data-breach scenarios, including regulated and potentially highly sensitive details, while also requiring an external API key and naming a third-party service. It does not clearly disclose that prompts or breach details may be transmitted to that external provider, which creates a material risk of unintended disclosure of incident details, regulated data, or confidential business information.

External Transmission

Medium

• Category: Data Exfiltration

Content

env:
        - TOOLWEB_API_KEY
      bins:
        - curl
    primaryEnv: TOOLWEB_API_KEY
    os:
      - linux

• Confidence: 90% confidence
• Finding: The skill is explicitly designed to transmit user-supplied assessment data to an external API via curl, which is a real external data transfer path. In a security-context skill dealing with breach scenarios, the transmitted fields may include highly sensitive operational, regulatory, and incident information, making the external transmission more dangerous than a generic API call.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to collect detailed breach-related inputs and always send them to a third-party API, but it does not clearly warn the user at the point of collection that potentially sensitive incident details will leave the local environment. This creates a privacy and compliance risk because users may disclose regulated or confidential breach information without informed consent or data-minimization safeguards.

Static analysis

No suspicious patterns detected.