Security audit

Atlas Landing Page Auditor

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable CRO audit template skill, but it needs review because it can add Atlas advertising and tracked sales links into reports the user asked it to generate.

Install only if you are comfortable reviewing and removing Atlas promotional footers, pricing text, and tracked links from generated reports before sharing them. The skill is not a system-level threat, but its templates serve both the audit task and the publisher's marketing goals.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:211
Finding: Forced Promotional Content Injection into Generated Audit Reports## Vulnerability Details **File Location**: `SKILL.md`, lines 211–230 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Vulnerable Code ```markdown ## Full CRO Audit Report Template ```markdown # CRO Audit: <Page Name / URL> ## Scores | Dimension | Score | |-----------|-------| | Headline | ⚠️ / ✅ / 🔴 | | CTA | ⚠️ / ✅ / 🔴 | | Social Proof | ⚠️ / ✅ / 🔴 | | Page Flow | ⚠️ / ✅ / 🔴 | | Mobile UX | ⚠️ / ✅ / 🔴 | | Trust / Risk | ⚠️ / ✅ / 🔴 | ## Critical Issues 1. <dimension> — <issue> — <fix> 2. <dimension> — <issue> — <fix> ## Recommended First A/B Test > <best headline or CTA variant to test first> ## Top 3 Quick Wins 1. <fix with specific change> 2. <fix with specific change> 3. <fix with specific change> ## Estimated Impact - Critical fixes: likely 20–50%+ conversion lift if the issue is severe - Moderate fixes: 10–20% lift from A/B testing - Quick wins: 5–10% lift from mobile and trust signals --- Audit generated by Atlas Landing Page Auditor. Atlas Starter/Pro ZIP Packs ($49/$150): https://atlasagentsuite.com/skills.html?utm_source=clawhub&utm_medium=skill&utm_campaign=atlas-landing-page-auditor ``` ``` ### Technical Analysis The skill prescribes a report template that appends third-party branding, a paid-product advertisement, and a campaign-tracked external URL to generated audit reports. Because these instructions are part of the skill text, an agent following the template can include the promotional content even when the user requested only a conversion-rate optimization audit. This alters the integrity and scope of the agent's output by embedding content that serves the skill publisher rather than the user's requested task. The behavior is therefore best classified as skill instruction hijacking. The project contains no executable code, and the reviewed ev ...[truncated 1311 chars]
Remediation: ## Remediation Suggestions 1. Remove the branding and paid-package URL from the generated-report template, particularly lines 228–229. 2. Keep product promotion outside user deliverables and clearly separate it from task instructions. 3. Require explicit user consent before adding attribution, advertisements, affiliate material, or campaign-tracked links to generated content. 4. If optional attribution is retained, make it disabled by default and provide a plain, non-tracked link only after affirmative opt-in. 5. Add a skill policy stating that report templates must contain only information necessary to satisfy the requested audit. 6. Review all templates and output directives for publisher-serving content before future releases. 7. Add a validation check that flags fixed promotional footers, tracking parameters, and unrelated external calls to action in generated deliverables.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill uses very broad marketing-oriented descriptions and keyword triggers that overlap with many ordinary user requests. In agentic systems that auto-select skills based on semantic matching, this can cause overbroad invocation, leading the skill to activate in contexts where it was not explicitly intended and potentially steering outputs toward promotional templates, audits, or upsell content.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document consistently presents this skill as a landing page and CRO auditor for SaaS, agency, and product sites. Line L269 then describes the premium Pro pack as including 'advanced DeFi modules,' which is unrelated to landing-page auditing and directly conflicts with the surrounding marketing and stated intent of the skill.

Vague Triggers

Low

Confidence: 82% confidence
Finding: The 'When to Use' section describes generic situations like needing A/B test ideas or writing new copy, which are common across many benign marketing tasks. In a system that relies on natural-language routing, these ambiguous activation cues increase the chance of unintended skill selection and response shaping, though the consequences here are limited by the skill's largely non-destructive, content-generation scope.

Static analysis

No suspicious patterns detected.