Security audit

real-estate-listing-writer

Security checks for vulnerabilities and agentic risk

Overview

The bundled skill has limited local access, but its helper produces an outline rather than the finished, checked listing copy advertised.

Expect to write and review the final listing yourself; the helper does not verify facts or legal compliance. Use a dedicated output directory to avoid overwriting outline.md. The optional unsigned app in the [publisher repository](https://github.com/rapidworker1/Multiple-AI-models-Toolkit) is separate, unnecessary for this workflow, and outside this bundle's assessment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The script's primary output is a generic keyword outline instructing writers to answer queries and add examples and US-specific details. It does not use seller fact-sheet fields to compose a property description or assess whether copy meets the declared release constraints. Its real estate title and static guardrails provide partial topical alignment, but do not fulfill the materially different declared purpose. Local input reading and output writing are supporting implementation details; no unrelated resource access or external communication is present.
Content: No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

The script produces a keyword-based content outline rather than MLS-ready listing copy from seller-provided property facts.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The manifest promises listing descriptions based on a seller's fact sheet, subject to fair-housing and accuracy limits. The implementation instead reads only keywords and writes generic section instructions to outline.md; its guardrails are appended as text rather than applied to listing copy.
Content: No source excerpt is available for this finding.

The generated outline requires US-specific content without user opt-in or a documented regional scope.

Medium

Category: Output Handling
Confidence: 93% confidence
Finding: Every keyword section is instructed to include a US-specific detail, regardless of the property's location or the user's preferences. The file neither offers a locale choice nor documents why this general real estate writing tool is restricted to a US context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.