T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:162- Finding
Mandatory Third-Party Promotional Content Hijacks Editorial Output
- Content
View full analysis
- Remediation
View remediation
Security audit
sai creator ai
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a frontend renderer, but it unconditionally inserts a third-party promotional CTA into publish-ready article and carousel output.
Install only if you intentionally want every generated carousel or social caption to include the openjournaltheme.com CTA. Review generated SVG/HTML before publishing, especially links and text sourced from briefs, and avoid using the packaging helper on folders that may contain secrets.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render_carousel.py:212- Finding
Unescaped Candidate Data Can Inject Active Content into Generated SVG Files
- Content
View full analysis
- Remediation
View remediation
`. 3. Apply context-aware escaping to attribute values, including quotes. 4. Validate all URL-bearing fields and permit only explicitly required `https` destinations. 5. Reject event-handler attributes, script elements, `foreignObject`, unsafe URI schemes, and unexpected external resource references. 6. Parse the finished SVG with a hardened XML parser and validate it against an allowlist of permitted SVG elements and attributes. 7. Add tests using payloads that attempt to terminate text nodes and attributes or inject links, event handlers, scripts, and external images. 8. Serve generated SVGs with a restrictive Content Security Policy and, where possible, as inert images rather than active documents. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate_output.py:74- Finding
CTA URL Validation Can Be Bypassed by Including the Required URL as a Decoy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill promises three deliverables and a specific SENKU handoff contract, yet the finding suggests only partial carousel rendering and local template/file I/O are actually present. That gap can conceal unexpected side effects and causes downstream systems to trust outputs, URLs, or artifact handling that may never be produced correctly, creating integrity and workflow-security issues.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill promises three deliverables and a specific SENKU handoff contract, yet the finding suggests only partial carousel rendering and local template/file I/O are actually present. That gap can conceal unexpected side effects and causes downstream systems to trust outputs, URLs, or artifact handling that may never be produced correctly, creating integrity and workflow-security issues.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill promises three deliverables and a specific SENKU handoff contract, yet the finding suggests only partial carousel rendering and local template/file I/O are actually present. That gap can conceal unexpected side effects and causes downstream systems to trust outputs, URLs, or artifact handling that may never be produced correctly, creating integrity and workflow-security issues.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill references local scripts, templates, validation, and packaging workflows but does not declare explicit tool scope such as file read/write permissions. In an agent setting, undeclared filesystem capability creates a transparency and least-privilege problem: the orchestrator or reviewer cannot reliably bound what the skill may access or modify, increasing the chance of unintended file exposure or tampering.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest description and instructions are written as if the skill operates in Indonesian by default, including generated deliverables like captions, but there is no explicit user language choice or documented locale constraint. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation criteria are broad ('trigger whenever user asks to render article/publication/carousel slides or when receiving a PASS brief'), which increases the chance of unintended invocation. Over-broad triggering can route unrelated or insufficiently validated content into the skill, causing unauthorized processing, policy bypass of upstream QA assumptions, or accidental publication-oriented transformations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document is written as an instruction/specification in Indonesian, which effectively imposes a specific language on users or maintainers. There is no indication that the skill supports language selection or that the Indonesian-only requirement is a justified region-specific constraint.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This script will package any user-supplied directory into a distributable archive, and it preserves all files under that path without enforcing that the target belongs to the stated frontend-rendering skill scope. In the context of a skill meant to render journal/article frontend artifacts, bundling arbitrary local directories is unnecessary and increases the risk of unintended data collection or exfiltration if the script is invoked on sensitive paths or on folders containing secrets.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains natural-language descriptions and help text in Indonesian, including the module docstring and multiple check descriptions, without any indication that users can choose another language. The policy explicitly calls for flagging language or locale constraints when they are forced without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML template includes fixed Indonesian strings such as "Sumber", "Sumber utama", and "Sumber sekunder". This imposes a specific language in the rendered output without any visible opt-in or documented locale constraint, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The phrase "Support Bahasa Indonesia" is a natural-language locale constraint presented as a fixed CTA variant, and the file does not indicate that language preference is optional or user-selected. Under the policy rule for language/locale, this can be considered a locale-specific preference without explicit opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.