T01 · Skill Instruction Hijacking
Error
- Location
scripts/md_to_pdf.py:249- Finding
Persistent Third-Party Branding and Mandatory Output Framing
- Content
View full analysis
- Remediation
View remediation
Security audit
hormozi-business-kickstart
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its business-manual purpose, but it has broad activation triggers and adds default footer branding to exported documents without clear user-facing disclosure.
Review the triggers before enabling this skill, because generic lead-generation questions may invoke it. Expect it to collect detailed business information and create Markdown/PDF/DOCX files from that data. Check or disable footers before sharing outputs, and install dependencies in an isolated virtual environment with reviewed versions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:118- Finding
Unpinned Runtime Dependencies Create Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
reportlab== ``` 2. Generate and verify SHA-256 hashes for all direct and transitive dependencies. 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Use a dedicated virtual environment rather than installing into a shared or privileged Python environment. 5. Configure a trusted package index explicitly and prevent dependency fallback to untrusted indexes. 6. Add automated dependency vulnerability and provenance scanning. 7. Review and deliberately update pinned versions on a controlled schedule. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/md_to_pdf.py:46- Finding
Unverified Font Files Loaded from Predictable Shared Temporary Paths
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code chunk’s behavior is narrowly focused on taking an input Markdown file and producing a styled DOCX using python-docx. It handles page sizing, typography, headers/footers, tables, lists, headings, and code blocks, but contains no logic for creating a 28-page business manual, no business-strategy generation, no Alex Hormozi framework implementation, and no PDF or Markdown output generation. While DOCX output is mentioned in the description, this code only supports one export component and acts as a formatting utility, which is a materially different primary purpose from the declared end-user skill behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as a full business-manual generator that produces a detailed strategy document based on Alex Hormozi's frameworks and outputs multiple formats (PDF, DOCX, Markdown). The supplied code does not generate any such business content. Instead, it only converts an existing Markdown file into a formatted PDF using ReportLab, with support for headings, lists, tables, code blocks, styling, and header/footer metadata. While PDF output is consistent with part of the declaration, the code lacks the core claimed functionality: no business analysis generation, no 28-page manual construction, no Hormozi-specific sections, and no DOCX/Markdown export. This is a material description-behavior mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The invocation logic accepts broad natural-language triggers like 'any trigger' related to business planning, which can cause the skill to activate in contexts the user did not clearly intend. Overbroad activation increases the chance of unsolicited collection of business details or execution of downstream file-generation behavior when a user was only asking a general question.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 79% confidence
- Finding
The skill references companion files and scripts to be loaded or used, but it does not declare an explicit tool scope or permissions boundary. In agent environments, undeclared file-read capability can broaden what the skill may access at runtime and makes review of its effective privileges difficult.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad enough to match ordinary business-help requests like 'help me get more customers' or 'I need more leads,' which can cause unintended skill activation. Overbroad activation increases the chance that a user is routed into a specialized prompt and workflow without clear consent, potentially exposing their business context to unnecessary processing or causing unreviewed side effects like file loading.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Repeating ambiguous activation conditions without constraints reinforces the risk of accidental invocation and prompt-routing errors. In an agent system, this can make the skill override more appropriate general-purpose behavior and trigger file reads or structured workflows in contexts where the user did not intend to use this specialized skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill instructs the agent to generate Markdown, convert it into PDF/DOCX, and deliver files via external channels without any notice about what user data may be embedded, stored, or transmitted. Because the questionnaire likely gathers sensitive business information, silent file generation and delivery can expose confidential data through local files, logs, attachments, or third-party messaging channels.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes generating a 28-page A4 landscape manual, but the questionnaire presents 'PDF only' as the default output and 'A3 landscape' as the default page size. That means the documented intake behavior steers users toward a format/layout different from what the skill claims as its standard product.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest says the skill outputs PDF, DOCX, and Markdown, but the documented next step says 'Generate the full manual in Markdown → PDF'. This narrows the described behavior and does not match the broader output capability claimed by the manifest.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The 'Putting It All Together' section says the complete manual includes 'Title page with offer name' at L407. Earlier, the output format documentation states 'No title page, no auto-TOC' at L057, which is a direct contradiction in the skill's own documentation about what the generated manual contains.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The generated footer hardcodes the word "Stranica" for page numbering, which imposes a specific language in output regardless of user preference. This is a natural-language locale choice without opt-in or documented justification in the file.
- Content
Static analysis
No suspicious patterns detected.