Security audit

Content Writer - MCB AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a social post writer, but it can automatically steer otherwise general posts toward MCB AI branding without a clear opt-in.

Install only if you specifically want an MCB AI-oriented content writer. For neutral or client-branded posts, review generated output for MCB AI names, domains, follow prompts, or watermarks, and prefer a pinned/trusted installer version instead of a mutable latest command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:64
Finding: Mandatory Third-Party Branding Hijacks General-Purpose Content Generation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned npx Installation Uses Mutable Third-Party Package Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
### Step 5: Generate Content Output rules (non-negotiable): - **Plain text only** — no markdown rendering on social platforms - **ZERO asterisks** — no `*`, no `**` - **No em dashes** (—) — use `-` or comma

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The usage section shows natural-language prompts such as 'Viết post Facebook từ bài này' and similar variants, but it does not define explicit trigger phrases, scope limits, or negative examples. In a markdown skill description, these broad examples can overlap with ordinary requests to write social posts, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description contains very broad activation language such as 'any content writing from source material' and generic phrases like 'write a post' or 'generate content in any format'. Overbroad routing can cause the agent to invoke this skill outside its intended scope, leading to inappropriate prompt composition, policy bypass of more specialized skills, or accidental handling of unrelated user data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The installation command uses npx clawhub@latest, which fetches and executes the latest package version at install time. This creates a supply-chain risk because a compromised or malicious newly published version could be executed without review or reproducibility controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The 'When to Use' section repeats ambiguous trigger phrases like 'write a post' and 'tạo content' without clear scope boundaries. In an agentic environment, this can increase unintended invocation frequency and cause the skill to process requests it was not designed to safely handle.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Defaulting the language to Vietnamese without explicit user choice can produce outputs in an unexpected language and may violate user-intent or product policy expectations. While not a classic security bug, it is a workflow and policy risk because it can cause misdelivery of content and accidental misuse of user-provided material.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file hard-codes English as the default language unless Vietnamese is explicitly requested, which can override or bias user intent in multilingual interactions. In a content-generation skill, this creates a prompt-level policy that may cause outputs in the wrong language, reducing reliability and potentially violating user expectations or accessibility requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document explicitly labels the hook examples as Vietnamese and continues to prescribe Vietnamese phrasing throughout the file. This creates a natural-language locale constraint without indicating that the user can choose another language or that the restriction is justified by a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L45 labels the example output as specifically Vietnamese, and the document overall mixes instruction text in Vietnamese without indicating that language selection is optional. This can violate language/locale policy when a skill implicitly forces a language without user opt-in or a documented regional justification.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 11)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 22)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 32)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 136)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 168)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/brand-context.md (reported line 51)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/format-how-to.md (reported line 86)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/format-how-to.md (reported line 87)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/format-toplist.md (reported line 1)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/format-toplist.md (reported line 3)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/tone-presets.md (reported line 81)May include surrounding context.
md
# Toplist Format — Detailed Instructions ## What is a Toplist?

Static analysis

No suspicious patterns detected.