Security audit

content-pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is an openly described content automation pipeline, but it can automatically publish to social platforms without review, which deserves careful user review before installation.

Install only if you want an agent to run an end-to-end content pipeline that may publish to social accounts. Use stage-by-stage mode, review generated content and destination accounts before publishing, and avoid --auto or --skip-review unless you have separate safeguards around social posting.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description is very broad and can match ordinary content-related requests, increasing the chance the agent invokes a workflow that includes drafting, design, and publishing when the user did not explicitly ask for all of those actions. In this skill's context, that broad trigger surface is more dangerous because later stages can cause external side effects such as publication to social platforms.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Options - `--auto` — Auto-execute all stages - `--step <plan|write|design|publish|track>` — Execute specific stage only - `--topic <topic>` — Specify content topic - `--skip-review` — Proceed without approval at each stage (risky)
Confidence: 91% confidence
Finding: The `--auto` mode enables autonomous execution of the full multi-stage workflow, including planning, writing, design, publishing, and tracking, with limited evidence of mandatory human intervention. While automation itself is not inherently malicious, in this context it materially increases risk because a single invocation can cascade into external posting and event-file propagation across stages.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - `--auto` — Auto-execute all stages - `--step <plan|write|design|publish|track>` — Execute specific stage only - `--topic <topic>` — Specify content topic - `--skip-review` — Proceed without approval at each stage (risky) ## Execution Flow
Confidence: 95% confidence
Finding: The `--skip-review` option allows the workflow to proceed without approval at each stage, removing human checkpoints before content is generated, transformed, and ultimately published. In this skill, that autonomy is especially risky because the pipeline culminates in social publishing, so mistakes or manipulated upstream inputs can directly lead to unauthorized or harmful external actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation describes auto-publishing to Instagram/SNS as part of the normal pipeline but does not present a strong, explicit warning that this performs an external action on behalf of the user. In context, this is more dangerous because the same skill also supports automatic progression through prior stages, making unintended public posting and reputational harm more plausible.

Static analysis

No suspicious patterns detected.