Phy Content Compound

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:58 AM UTC
• Version: 1.0.3

Overview

This skill is a local, user-directed content scanner that reads chosen text folders and prints reusable excerpts, with no evidence of persistence, network access, or destructive behavior.

Install only if you are comfortable letting it read the markdown and text files in the folder you point it at. Use a curated content folder rather than a broad home, work, or notes directory because excerpts and file paths may appear in terminal output or JSON logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill clearly instructs the agent/user to run a local script over arbitrary directories of personal content, which implies file-read capability, but the manifest does not declare any tool scope or permissions. That mismatch weakens user consent and review controls because consumers of the skill are not explicitly warned at the permission layer that local files will be accessed recursively.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: Content Compound
description: Content atom library builder for social media creators. Scans a directory of your past content (markdown, text files) and extracts reusable "content atoms" — claims, data points, anecdotes, frameworks, contrarian takes, and questions. Tags each with topic keywords and source attribution. When given a new topic, retrieves the most relevant atoms from your personal library and generates a post outline. Like Zettelkasten but automated — every post you write makes the next one easier. Solves the 77% creator burnout problem by eliminating "blank page" starts. Research-backed (Zettelkasten serendipity effect, Justin Welsh 730-day content library, content atomization hub-and-spoke model). Zero external dependencies.
license: Apache-2.0
homepage: https://canlah.ai
metadata:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start usage tells users to point the tool at broad local directories, but the skill does not prominently warn that it will recursively scan files and extract reusable text fragments with source attribution and line references. This can expose sensitive drafts, private notes, customer data, or confidential strategy material if users run it on overly broad folders.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This skill recursively scans user-supplied directories, reads local .md/.txt files, extracts substantial snippets, and then prints those excerpts and source paths back to stdout or JSON without any explicit consent gate, privacy warning, or output redaction. In an agent setting, that behavior can unintentionally expose sensitive personal notes, drafts, secrets copied into text files, or internal file structure to the caller or downstream logs.

Static analysis

No suspicious patterns detected.