Security audit

Nexl Brand Site Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent brand-site builder, but it stores and re-shares potentially sensitive brand information and under-describes some network/deployment behavior.

Install only if you are comfortable with the agent collecting and storing a brand profile. Avoid putting confidential pricing, unreleased product plans, private contacts, or legal red lines into the profile unless you control the workspace and know where the file or bot knowledge entry will be stored. Ask the agent to use a non-persistent or redacted profile, review any public deployment before publishing, and remove local profile files when no longer needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims to be self-contained and to require no external network fetches, but later directs the agent to consult online inspiration sources and produce a public deployment URL. This mismatch can mislead users and host platforms about the skill's actual network behavior, increasing the chance of unexpected outbound access or policy bypass in restricted environments.

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The skill instructs the agent to fingerprint its host platform by inspecting runtime tools and capabilities, which exceeds what is strictly necessary for generating a website. While not directly exfiltrating data, environment introspection can reveal host details and normalize broader capability probing that may violate least-privilege expectations.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The skill expands from site generation into persistent cross-session storage and reuse of a brand profile, effectively creating a memory system containing user-supplied business details. This broadens the data handling scope beyond the manifest's core purpose and creates privacy and retention risks if users do not clearly consent to storage.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill again contradicts its self-contained claim by instructing use of external inspiration repositories when internal templates are insufficient. In restricted or security-sensitive environments, this can trigger unanticipated network access and import unvetted external influence into agent behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly instructs local persistence of a `brand-profile` containing sensitive business information such as pricing strategy, unreleased products, and compliance red lines, but it does not require an explicit user consent flow or a concrete warning about local storage exposure. In local runtimes, writing such data to a predictable path like `./brand-profile.md` can create unintended retention, leakage through workspace sync/backups, or accidental inclusion in version control.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to persist and reuse a cross-session brand-profile and store it in predictable locations, including a local home-directory path and current working directory copy. Because the profile may contain identifying business, contact, and strategic information, this creates an exposure path through unintended retention, local file access by other processes, or accidental inclusion in shared project directories.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill repeatedly requires the agent to render and deliver the full brand-profile as a copyable text block. That increases the chance of oversharing user-provided information in chat transcripts, logs, screenshots, or onward prompts, especially when the profile contains strategic, personal, or contact details.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The final delivery checklist mandates bundling the full brand-profile with the site output, creating a built-in channel for redistribution of user data alongside deliverables. This materially increases the risk of accidental publication, sharing with third parties, or inclusion in deploy artifacts where the profile does not belong.

Static analysis

No suspicious patterns detected.