Security audit

Text Message Ad

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its advertised purpose, but its raw HTML templating can turn supplied ad text into executable code in the rendered and delivered files.

Review this before installing if the skill may handle untrusted product copy, domains, logos, or brand files. It should HTML-escape all inserted text, validate URLs/colors/images, add a restrictive CSP, block external browser requests during rendering, and keep generated outputs in a dedicated directory. Also use it only for clearly fictional, disclosed marketing dramatizations.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:40
Finding: Unescaped User-Controlled Content Can Produce Executable HTML
Content: View full analysis
A
Alex ›
``` ```html
Ugh, [customer states the painful problem in their own words] 😩

[Friend reframes: what's actually needed / busts the expensive myth]

[Friend names YourProduct + price + one concrete proof point]
``` ```html
YourProduct™
One-line value proposition

YourProduct™ — Short Descriptive Title

yourdomain.com

``` ```html
YourProduct™

[One-sentence positive-framing tagline: what the customer ...[truncated 3036 chars]
Remediation: View remediation
``` 5. **Harden Playwright rendering** - Intercept requests and abort all non-`file:` and non-`data:` requests. - Render generated files in a dedicated temporary directory with minimal readable content. - Use a disposable browser context and close it in a `finally` block. - ...[truncated 405 chars]

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger guidance includes very broad phrases such as using this skill even when the user only says 'make an ad for my product' or 'another version for X', which can cause the skill to activate outside its narrow 'text-message ad' niche. Misrouting generic ad requests into this skill is risky because it normalizes generation of fake chat/testimonial-style content and may bypass more appropriate, lower-risk ad workflows.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
node scripts/render.js config.json # deterministic frame stepping (audio-sync exact)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to write HTML, JSON, and media outputs and to invoke rendering commands, which implies file-writing and code-execution-adjacent behavior, but it declares no explicit tool scope or allowed-tools boundary. Without an explicit permission manifest, an orchestrator may grant broader filesystem capabilities than intended, increasing the chance of unauthorized writes, overwrites, or misuse in adjacent directories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document declares lang="en", which hard-codes English as the page language. Under the policy, locale-specific behavior should offer user choice or be clearly justified; this file provides neither.
Content: No source excerpt is available for this finding.