Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md "files": ["SKILL.md"],
Security audit
Classify Customer Intents with AI — Route to Slack & CRM
Security checks for vulnerabilities and agentic risk
Overview
This is a single-file customer-intent classification skill, but it encourages broad analysis of customer communications and automated routing/actions without clear privacy and approval boundaries.
Review this skill before installing if you plan to use it on real customer data. Treat customer messages as sensitive, redact PII and secrets, confirm authorization for OpenAI and workflow-tool processing, disable automatic CRM/Slack/customer-impacting actions until reviewed, and avoid relying on the blanket GDPR/CCPA claim without your own compliance controls.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill description is framed broadly for real-time intent detection across many customer communication channels without defining clear invocation constraints, consent prerequisites, or data-sensitivity limits. In practice, that increases the chance the skill will be used on sensitive customer content by default, including cases where sending data to a third-party model is inappropriate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The overview promotes analyzing support tickets, DMs, emails, and comments across external platforms, but it does not prominently warn that this content may be sent to a third-party API provider. Because these inputs commonly contain personal, confidential, or commercially sensitive information, omission of an upfront disclosure can lead to accidental data exfiltration and noncompliant processing.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's safety section says it only returns recommendations and does not automatically send messages, but other sections explicitly describe routing to Slack/CRM and triggering follow-up automations. This inconsistency can mislead operators about the degree of automation and human oversight, increasing the risk of unauthorized outreach or autonomous business actions based on imperfect classifications.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Although this line says the skill will not automatically send emails/messages, the broader document repeatedly describes automated routing, notifications, and workflow triggers. That mismatch can conceal autonomous downstream actions taken from model output, which is risky because classification errors can directly affect customer treatment, sales motions, or retention interventions.
- Content
md ### What This Skill WILL NOT Do ❌ **Make final decisions** → Always flag low-confidence classifications for human review (< 65%) ❌ **Automatically send emails/messages** → Returns recommendations only; humans control outreach ❌ **Guarantee perfect accuracy** → Depends on input quality; ambiguous text may score evenly across buckets ❌ **Access customer data without consent** → Requires explicit permission to analyze; doesn't store or log data (unless configured) ❌ **Override business logic** → Recommendations are suggestions, not rules; your playbooks take precedence
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ❌ **Make final decisions** → Always flag low-confidence classifications for human review (< 65%) ❌ **Automatically send emails/messages** → Returns recommendations only; humans control outreach ❌ **Guarantee perfect accuracy** → Depends on input quality; ambiguous text may score evenly across buckets ❌ **Access customer data without consent** → Requires explicit permission to analyze; doesn't store or log data (unless configured) ❌ **Override business logic** → Recommendations are suggestions, not rules; your playbooks take precedence ❌ **Detect sarcasm 100%** → Sarcasm and irony may be misclassified; review high-confidence satire flagged by human reviewers
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document claims no data retention and strong privacy/compliance posture, but elsewhere says classifications may be logged for continuous learning and sent to workflow integrations such as Slack, CRMs, and dashboards. Those conflicting statements can cause users to process customer communications under false assumptions about storage, sharing, and compliance obligations, creating privacy and regulatory exposure.
- Content
Static analysis
No suspicious patterns detected.