Security audit

Doc Coauthoring Anthropic

Security checks for vulnerabilities and agentic risk

Overview

This documentation co-authoring skill is coherent and disclosed, with the main caution that users should intentionally scope any workplace documents or messaging channels they let it read.

Install only if you want an agent to guide substantial document drafting. When using workplace connectors, name the exact files, threads, or channels to inspect and avoid broad searches over sensitive workspaces unless that context is truly needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill metadata says to use the workflow whenever the user wants to write documentation, proposals, technical specs, decision docs, or similar structured content, which is broad enough to activate in many ordinary conversations. Over-broad activation can cause the agent to prematurely enter a workflow that requests files, links, and external context, increasing the chance of unnecessary data access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "write up" is highly generic and overlaps with everyday requests that may not warrant this workflow. Because this skill later encourages reading files, linked docs, and connected sources, a generic trigger raises the risk of invoking higher-privilege behavior from an ambiguous user statement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly encourages pulling context from messaging platforms and shared document systems, which expands data access beyond the immediate user-provided drafting task. Even though framed as productivity help, this can cause unnecessary retrieval of sensitive internal information and over-collection if the user’s request is vague or the connected sources contain unrelated confidential data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs the agent to search connected tools for unknown entities or projects, which can turn a simple documentation workflow into exploratory cross-system discovery. This increases the risk of exposing sensitive project names, internal discussions, or confidential metadata that the user did not specifically request to retrieve.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The condition 'User seems to be starting a substantial writing task' is inherently subjective and does not define measurable activation boundaries. Different agents could interpret it differently, causing inconsistent or unintended skill use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.