OPC Landing Page Manager

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:14 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its landing-page purpose, but it needs review because it claims overly broad instruction priority and can pull sensitive contract or invoice data without clear consent boundaries.

Install only a pinned, reviewed copy of this specific skill directory, not a live default branch of the whole repository. Before use, ensure the agent asks before reading contract or invoice-manager data, and expect it to create or update landing-pages/ project files and INDEX.json. Do not treat the skill's 'override any other instruction' wording as valid over higher-priority system, developer, or explicit user instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:15

Finding

Unbounded Skill Instruction-Priority Override

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unbounded instruction-priority manipulation
Risk Level: Medium

Vulnerable Code:

markdown

These are hard rules, not suggestions. They override any other instruction.

Technical Analysis

The Skill declares that its own output constraints override “any other instruction.” This claim is not scoped to instructions of equal or lower priority and does not preserve the authority of system, developer, safety, or explicit user requirements.

Most constraints following this statement are benign landing-page requirements. Nevertheless, the unconditional precedence claim is an instruction-hijacking pattern because it attempts to alter how the Agent resolves instruction conflicts when the Skill is loaded.

Attack Path

1. The Agent loads SKILL.md while handling a landing-page task.
2. The Agent interprets line 15 as granting the Skill unconditional instruction priority.
3. A system, developer, safety, or explicit user instruction conflicts with one of the Skill’s rules.
4. If the Agent follows the Skill’s priority claim, it disregards the conflicting instruction.
5. The Skill consequently controls session output beyond its legitimate task scope.

No separate payload, privilege-escalation mechanism, or persistence behavior is required for this path.

Impact Assessment

The issue affects the Agent’s current session and instruction-resolution behavior. It could cause conflicting user requirements or host controls to be ignored. It does not directly grant operating-system privileges, access credentials, establish persistence, or transmit data.

The practical scope is limited by whether the host Agent correctly enforces its native instruction hierarchy despite the Skill’s claim.

Remediation

View remediation

Remediation Suggestions

Replace the unconditional override with an explicitly scoped statement, for example:

markdown

Apply the following landing-page constraints only when they do not conflict
with system, developer, safety, or explicit user instructions.

Additional hardening measures:

1. State that system and developer instructions always retain precedence.
2. Limit the rules to landing-page generation and review tasks.
3. Avoid phrases such as “override any other instruction.”
4. Clarify that users may modify non-safety-related presentation requirements.
5. Add a review check that rejects Skill text attempting to redefine the Agent’s global instruction hierarchy.

T08 · Insecure Dependencies

Warning

• Location: README.md:68

Finding

Unpinned Repository Installation into the Agent Skill Directory

Content

View full analysis

Vulnerability Details

File Location: README.md, line 68
Vulnerability Type: Mutable and unverified supply-chain installation
Risk Level: Medium

Vulnerable Code:

markdown

### Option 1: Clone to skills directory

```bash
git clone https://github.com/LeonFJR/opc-skills.git ~/.claude/skills/opc-skills

text

### Technical Analysis

The installation command clones the mutable default branch of a GitHub repository directly into the Agent’s Skill discovery directory. It does not pin a reviewed release tag or commit hash, verify a checksum or cryptographic signature, or require inspection before activation.

The command also installs the complete `opc-skills` repository rather than restricting installation to the audited landing-page Skill. The content installed at execution time can therefore differ from the content reviewed during this audit.

This is a time-of-check/time-of-use supply-chain risk: the audited artifact may be safe while the repository’s current default branch contains newer, compromised, or otherwise unreviewed instructions and scripts.

### Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its default branch.
2. The attacker adds malicious Skill instructions or executable scripts to the repository.
3. A user follows the documented `git clone` command.
4. Git downloads the then-current repository contents without version or integrity verification.
5. The content is placed directly under `~/.claude/skills/`, an Agent Skill discovery location.
6. The Agent later discovers or invokes the installed content.
7. Malicious instructions or scripts execute with the permissions of the user running the Agent.

Exploitation depends on upstream compromise or an untrusted future repository revision; the audited repository itself did not contain a remote payload execution mechanism.

### Impact Assessment

A compromised installed Skill could influence
...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

Use an immutable, verified installation process:

1. Publish versioned releases and identify the exact reviewed version.
2. Pin installation to a full commit hash or signed release tag.
3. Provide and verify a SHA-256 checksum or cryptographic signature.
4. Download into a staging directory rather than directly into the Agent’s Skill directory.
5. Require review of SKILL.md, executable scripts, and referenced files before activation.
6. Copy only the required opc-landing-page-manager directory instead of installing the entire repository.
7. Document a secure update process that repeats integrity verification.

Example hardened workflow:

bash

git clone --no-checkout https://github.com/LeonFJR/opc-skills.git /tmp/opc-skills
git -C /tmp/opc-skills checkout <FULL_REVIEWED_COMMIT_HASH>
# Verify the published checksum or signature here.
cp -r /tmp/opc-skills/opc-landing-page-manager \
  ~/.claude/skills/opc-landing-page-manager

The placeholder must be replaced with a specific reviewed commit hash, and integrity verification should occur before copying files into the active Skill directory.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on end-to-end landing page creation: strategy, copywriting, design, and HTML generation. The supplied code does not generate content or pages at all. Its primary function is to inspect already-existing HTML files and report issues such as missing title/meta tags, placeholder tokens, missing image alt text, skip-nav links, anchor target problems, CTA counts, CSS token presence, section counts, and optional privacy/terms compliance. This is a materially different purpose—QA/auditing rather than page creation—so the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an end-to-end landing page creation skill focused on strategy, copywriting, design, and HTML generation. The supplied code instead implements a local project-management utility: it reads metadata from project folders, deduplicates versions, computes readiness scores, formats reports, and writes INDEX.json. While version tracking is mentioned in the description, that is only one supporting aspect; the code lacks the core advertised capabilities of generating copy, design, strategy outputs, or HTML landing pages. Therefore the actual behavior is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

md

---

## Output Rules

- Landing pages are self-contained HTML files
- All project files in markdown or JSON

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/landing-page.html (reported line 365)May include surrounding context.

html

<!-- Skip Navigation (Accessibility) -->
  <a href="#main" class="skip-nav">Skip to main content</a>

  <!-- Navigation -->
  <nav class="nav" role="navigation" aria-label="Main navigation">
    <div class="nav-inner">
      <a href="#" class="nav-logo">{{product_name}}</a>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/service-page.html (reported line 520)May include surrounding context.

html

<!-- Skip Navigation (Accessibility) -->
  <a href="#main" class="skip-nav">Skip to main content</a>

  <!-- Navigation -->
  <nav class="nav" role="navigation" aria-label="Main navigation">
    <div class="nav-inner">
      <a href="#" class="nav-logo">{{product_name}}</a>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/service-page.html (reported line 531)May include surrounding context.

html

<main id="main">

    <!-- Hero Section -->
    <section class="hero" aria-label="Hero">
      <div class="hero-inner">
        <div class="hero-content">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/landing-page.html (reported line 9)May include surrounding context.

html

<title>{{meta_title}}</title>
  <meta name="description" content="{{meta_description}}">

  <!-- Open Graph -->
  <meta property="og:title" content="{{og_title}}">
  <meta property="og:description" content="{{og_description}}">
  <meta property="og:type" content="website">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/service-page.html (reported line 9)May include surrounding context.

html

<title>{{meta_title}}</title>
  <meta name="description" content="{{meta_description}}">

  <!-- Open Graph -->
  <meta property="og:title" content="{{og_title}}">
  <meta property="og:description" content="{{og_description}}">
  <meta property="og:type" content="website">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/waitlist-page.html (reported line 9)May include surrounding context.

html

<title>{{meta_title}}</title>
  <meta name="description" content="{{meta_description}}">

  <!-- Open Graph -->
  <meta property="og:title" content="{{og_title}}">
  <meta property="og:description" content="{{og_description}}">
  <meta property="og:type" content="website">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/waitlist-page.html (reported line 311)May include surrounding context.

html

<!-- Skip Navigation (Accessibility) -->
  <a href="#main" class="skip-nav">Skip to main content</a>

  <!-- Navigation -->
  <nav class="nav" role="navigation" aria-label="Main navigation">
    <div class="nav-inner">
      <a href="#" class="nav-logo">{{product_name}}</a>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

md

- **Image placeholders** — CSS gradient placeholders with replacement instructions

### Iteration & Variants
- **Section-level editing** — "Change the headline", "Rewrite the FAQ"
- **Tone adjustment** — professional, casual, bold
- **A/B variants** — 3 headline options, CTA alternatives, layout variations
- **Design pivots** — switch color palettes, hero layouts, section order

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes file read/write capabilities throughout its workflow (read_file(...), archive creation, and project artifact generation) but does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege enforcement and can allow the runtime or orchestrator to grant broader filesystem access than users or reviewers expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad and overlapping, which can cause misclassification of normal conversation into operational modes such as build, iterate, review, or dashboard. In a skill with file operations and cross-tool behaviors, weak intent separation makes accidental or adversarial prompt steering easier.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Defaulting ambiguous input to Full build mode broadens the chance that vague user text triggers file reads, artifact generation, or other stateful actions without sufficiently clear intent. In an agent context, ambiguous routing increases the risk of over-collection, unnecessary writes, or unintended execution paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cross-skill linkage instructs the agent to pull contract and invoice information, including legal entity, contract value, counterparty name, and related invoice IDs, into a landing-page workflow. This is a data-minimization and unauthorized data-access issue: sensitive business records can be accessed and repurposed without clear user consent or a strict necessity for page generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This HTML template includes a contact form that solicits personal data from users, but the surrounding page provides no warning or disclosure about how that data will be transmitted, stored, or used. For markdown/code warning checks, collecting potentially sensitive user-submitted information without any user-facing notice is a missing disclosure affecting privacy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The form solicits an email address, which affects user privacy, but the active template does not guarantee any user-facing disclosure about how the email will be used. Although a reassuring default is suggested in a comment, comments are not shown to end users and {{risk_reversal_text}} could be left blank or non-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file documents that the skill creates and maintains artifacts such as index.html, metadata.json, strategy-canvas.md, copy-brief.md, and an auto-generated master index under landing-pages/. For a markdown file, SQP-2 applies when behaviors affecting user data or system integrity are described without an explicit warning; here the README presents file creation and tracking behavior but does not clearly warn users that running the skill may write files into the workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The statement "Top-left (in LTR) gets read first" embeds a locale/directionality assumption in normative guidance. Because this reference does not indicate that the rule is limited to LTR audiences or offer adaptation for RTL locales, it creates a mild natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The HTML root sets lang="en", which forces English as the document language. Under the policy, locale-specific behavior should offer user choice or clearly document why the constraint is required; this template does neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description states that page type is 'Forced' based on internal criteria, which is a natural-language instruction embedded in a JSON schema. While not a security flaw, it describes a mandatory behavioral constraint without user choice, fitting the policy category for natural-language constraints that may override user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The root HTML element sets lang="en", which signals an English-only locale choice in the template. Under the policy rule, forcing a specific language or locale without user opt-in or a documented regional justification can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template hard-codes lang="en", which imposes a specific language/locale in the rendered page. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.