Viral Restaurant Marketing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 1.0.0

Overview

This restaurant marketing skill is mostly coherent, but it includes review-incentive, customer-privacy, and public-posting guidance that users should review before installing.

Install only if you are comfortable reviewing its marketing outputs before use. Do not offer rewards in exchange for Google reviews, get consent before filming identifiable customers or using reviewer names, redact review screenshots unless permission is explicit, and require manual approval before any Postiz or social posting automation publishes content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The supplied code is specifically a 'viral hook generator' for restaurant TikTok/Instagram content. It defines hook templates by style, fills restaurant-specific variables, and outputs hooks in markdown/text/JSON along with basic usage tips and example captions. This aligns with the 'hook writing' portion of the description and partially with social content help. However, the declared purpose materially overstates the skill's scope by claiming capabilities for content calendar generation, Google Reviews growth, and website conversion optimization, none of which appear in the code. There is no review platform integration, no calendar/planning logic, and no website/CRO analysis or optimization functionality. Therefore the description does not accurately represent the actual implemented behavior.

Ae1

High

• Category: analysis-evasion

Content

- scripts/generate-content-calendar.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- scripts/generate-content-calendar.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- scripts/generate-content-calendar.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- scripts/restaurant-hooks.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- scripts/restaurant-hooks.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The phrase "Asks about restaurant marketing in general" is broad and lacks clear boundaries for when this skill should activate versus when a more specific marketing or business skill should be used. Because it maps to a wide range of everyday advisory requests, it increases the chance of unintended invocation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The recommendation to run a 'Win a free meal' contest where entry equals leaving a Google review can incentivize reviews and may violate platform review-integrity rules or consumer-protection requirements. This can lead to account penalties, removed reviews, reputational harm, or legal/compliance issues for users following the guidance.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The API example sends content to an external service using a bearer token but provides no warning about data handling, user consent, or secret-management expectations. In an agent skill context, examples like this can normalize transmitting user or business content off-platform without clear authorization boundaries.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Postiz API Integration (if automating):**
```javascript
// Post via Postiz API
const response = await fetch('https://api.postiz.com/v1/posts', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.POSTIZ_API_KEY}`,

• Confidence: 87% confidence
• Finding: Referencing a third-party API endpoint in executable integration guidance is a true external transmission risk because it operationalizes sending data outside the local environment. While the example is not automatically executed here, it lowers the barrier to unsafely transmitting content and credentials in downstream use.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Postiz API Integration (if automating):**
```javascript
// Post via Postiz API
const response = await fetch('https://api.postiz.com/v1/posts', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.POSTIZ_API_KEY}`,

• Confidence: 87% confidence
• Finding: Referencing a third-party API endpoint in executable integration guidance is a true external transmission risk because it operationalizes sending data outside the local environment. While the example is not automatically executed here, it lowers the barrier to unsafely transmitting content and credentials in downstream use.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The file explicitly instructs users to show a 5-star Google review with the reviewer’s first name visible, which promotes sharing identifiable personal information in marketing content without clear consent. In this skill context, that creates privacy and data-protection risk because customer reviews may be repurposed beyond the platform’s original context, potentially violating expectations, platform rules, or local privacy law.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The generated filming guidance explicitly encourages recording real customers and thanking reviewers by name without embedding a privacy or consent safeguard in the output. In a marketing skill context, users may operationalize this advice directly, creating a realistic risk of unauthorized filming, misuse of personal data, or platform/legal complaints.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: The manifest says the skill triggers on keywords like several restaurant-marketing phrases, but it does not define whether the list is exhaustive or provide any negative examples. Without scope constraints, simple keyword matching could activate the skill in contexts where the user is only casually mentioning those terms.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The skill includes user-facing example copy in Dutch (for example, "Wil jij dat we [dish] toevoegen?") while presenting the rest of the material in English, but it does not state that output should be localized only for Dutch-speaking users or offer a language choice. This can amount to an implicit language/locale preference without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The review response templates are written in Dutch, but the skill does not say these are region-specific examples or instruct the agent to confirm the user's preferred language first. That creates a natural-language locale bias that may conflict with organizational language-choice expectations.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The examples and guidance repeatedly anchor the content to Belgium-specific context, such as references to Belgium, Ghent, and Belgian campaign examples, without offering locale choice or stating that the skill is intended only for Belgian or Netherlands restaurant operators. This can amount to a natural-language locale policy issue because the content implicitly forces a regional framing rather than making it optional.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The generated content, labels, CTAs, and filming notes are written in English, and this line explicitly says subtitles are mandatory for the format without any language selection or locale opt-in. That can violate language/locale policy where skills should not force a specific language absent user choice or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The generated content defaults to Dutch phrases such as "ons restaurant" and "België", which influences output language and locale even when the user has not opted into Dutch. This is a natural-language locale policy concern because the skill implicitly forces a specific locale instead of offering a language or region choice.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The caption template hardcodes the Dutch phrase "Tag iemand die dit moet proberen," so every generated caption includes Dutch regardless of user preference. That constitutes a language-choice policy issue because the skill does not provide any opt-in or documented justification for enforcing this locale.

Static analysis

No suspicious patterns detected.