Market Research Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:08 AM UTC
• Version: 1.0.0

Overview

The skill is a local mock report generator, but its documentation can make users believe it performs real social-media and competitor research.

Review before installing. Treat outputs as templates or mock examples unless you independently provide and verify real data. Avoid running the dependency install as written; use an isolated environment and only install packages that are actually needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:142

Finding

Unnecessary and Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 142
Vulnerability Type: Unpinned and unnecessary third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install requests beautifulsoup4 pandas

Technical Analysis

The installation command does not constrain package versions or verify package hashes. Consequently, package resolution depends on the mutable state of the user's configured Python package index at installation time. This makes installations non-reproducible and exposes users to compromised releases, dependency-index substitution, and malicious transitive dependencies.

The audited Python script does not import or otherwise use requests, beautifulsoup4, or pandas; its current implementation relies only on the Python standard library and hard-coded mock data. Installing these packages therefore creates an unnecessary supply-chain attack surface without supporting any implemented functionality.

Attack Path

1. A user follows the prerequisite instructions in SKILL.md.
2. The user executes pip install requests beautifulsoup4 pandas.
3. Pip resolves unpinned package versions and transitive dependencies through the user's configured package index.
4. If that index, a resolved release, or a transitive dependency has been compromised or substituted, attacker-controlled installation or package code may run in the user's Python environment.
5. Such code executes with the operating-system privileges of the account running pip and can affect files and resources accessible to that account.

Impact Assessment

Exploitation is conditional on compromise or substitution within the dependency-resolution chain; no malicious package is present in the audited project itself. If exploited, arbitrary code could run with the privileges of the user performing the installation. The accessible scope could include that user's Python environment, project files, user-writable fi ...[truncated 224 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the dependency-installation instruction because the current script does not use any of the listed packages.
2. If future live API or scraping functionality requires third-party libraries, declare only the packages that are actually imported.
3. Pin reviewed direct and transitive dependency versions in a lock file.
4. Use cryptographic hash verification, such as pip's --require-hashes, to ensure package integrity.
5. Install packages from a trusted, explicitly configured package index.
6. Perform installation inside an isolated virtual environment without administrative privileges.
7. Add automated dependency auditing and controlled update procedures before accepting newer releases.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documentation materially misrepresents behavior by claiming social-media mining and data-based competitor analysis while also indicating the implementation uses mock or static data and includes additional survey-generation behavior. This mismatch can mislead users and orchestrators into trusting outputs as real external intelligence, causing unsafe business decisions or improper routing of the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill exposes file-writing capability through documented commands that accept an output path, but it declares no tool scope or permissions. This creates an authorization gap where an agent may invoke write-capable behavior without explicit user-visible constraints, increasing the risk of unintended file creation or overwrite.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad and overlap with many ordinary business queries, increasing the chance that the skill activates in contexts where the user did not specifically request it. Combined with misleading capability claims, overbroad activation can amplify accidental use of mock-data analysis or unintended file output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file states both that analysis is based on obtained data and not fabricated, and that the current version uses mock data. This contradictory claim can deceive users into treating synthetic outputs as factual research, which is especially risky in market research where decisions may depend on data provenance and accuracy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes an automation skill that mines user pain points from social media and analyzes competitors for market validation. In this file, the implementation relies entirely on static in-memory dictionaries and templated findings, with no social-media ingestion, scraping, search, or real data collection logic; this is a substantive mismatch between claimed functionality and actual behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The stated purpose focuses on mining user pain points from social media and analyzing competitors. The generate_survey feature creates a full survey instrument for future data collection, which is adjacent to market research but not part of the manifest’s described behavior and represents extra functionality beyond the declared scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.