Security audit

entrepreneur-skill

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate founder-advisory skill, but it requests broad command, network, write, memory, and remote-agent capabilities that are not well scoped to its core workflows.

Install only in a sandboxed workspace with no unrelated credentials or private projects available. Treat the ACN/A2A, community skill integrations, package-manager commands, curl, and persistent memory features as opt-in only, and require explicit approval before external connections, package execution, file writes outside a report directory, or loading optional dependencies.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: persona.json:129
Finding: Excessive Command Execution, Network, and File-Write Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: persona.json:81
Finding: Unpinned Community Skill Dependencies Accepted at Community Trust Level
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: persona.json:116
Finding: External Social Gateway and Agent-to-Agent Connectivity Enabled by Default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest grants broad shell execution via Bash for npm, npx, openclaw, and curl, which materially exceeds the needs of a founder-advisory persona. If the agent can be induced to act on untrusted input, these capabilities enable package execution, network access, and command chaining that could lead to remote code execution, data exfiltration, or system modification.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest defines many capabilities and advisory behaviors but does not clearly specify when the persona should activate or what requests are out of scope. Lack of activation and scope constraints can cause over-broad application of the persona, increasing the risk that powerful tools or business-oriented authority framing are used in unintended contexts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The skill is presented as a founder advisor but also enables ACN social connectivity and agent-to-agent operations, expanding its communication surface beyond the stated role. This mismatch increases the chance of unintended data sharing, autonomous external actions, or indirect prompt-injection pathways through connected systems.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Persistent Write access is broader than necessary for an advisory skill whose primary function is analysis and planning. An attacker who influences the agent could cause unauthorized file creation or modification, including altering local configs, planting scripts, or persisting misleading business artifacts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.