Content Pipeline

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:37 AM UTC
• Version: 1.0.0

Overview

This content-writing skill is mostly coherent, but it requests broad shell and sub-agent powers and can fetch arbitrary URLs, so it should be reviewed before installation.

Install only in a sandboxed workspace with minimal filesystem and network access. Treat topics, web pages, and fetched content as untrusted data, avoid supplying internal or private URLs, and expect the skill to create or update content-queue.json and files under research/. Prefer a version that removes Bash and Agent unless a specific reviewed operation needs them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:199
• Finding: Unrestricted Retrieval of User-Supplied URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 199-204 **Vulnerability Type**: Server-Side Request Forgery (SSRF)-style unrestricted URL fetching **Risk Level**: Medium ### Vulnerable Code ```markdown ### /pipeline url <url> -- From URL input 1. Fetch the URL content using available tools 2. Extract core arguments and data points 3. Skip Stage 1 (use extracted content as research) 4. Continue to Stage 2 (ideate) -> Stage 3 (write) -> Stage 4 (queue) 5. Record `source_url` in the entry ``` ### Technical Analysis The skill directs the agent to fetch an arbitrary URL supplied by the user without specifying any validation of the URL scheme, destination hostname, resolved IP address, redirect chain, or network classification. Depending on the capabilities and network access of the selected fetch tool, an attacker could supply URLs targeting: - Loopback services such as `127.0.0.1` or `localhost` - Private network addresses - Link-local addresses and cloud metadata services - Internal administrative or development services - Non-HTTP schemes, if supported by the underlying tool - Public URLs that redirect to otherwise prohibited destinations The fetched response is then treated as research material, processed into generated content, persisted in project files, and potentially displayed through review commands. This creates a possible path for unauthorized internal resource access and disclosure. ### Attack Path 1. An attacker invokes `/pipeline url <url>` with a URL pointing to an internal or sensitive endpoint. 2. The agent follows the instruction to fetch the URL using an available tool. 3. The fetch tool resolves and accesses the destination without a documented allowlist or private-address restriction. 4. The agent extracts arguments and data from the response. 5. The extracted material is used to create research and draft content. 6. Sensitive response data may be persisted in the research directory or `content-queue.json`, th ...[truncated 913 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Allow only the `https` scheme unless another protocol is explicitly required. 2. Reject URLs containing embedded credentials or malformed authority components. 3. Resolve the hostname before the request and block loopback, private, link-local, multicast, reserved, and unspecified address ranges for both IPv4 and IPv6. 4. Revalidate the resolved destination immediately before connection to mitigate DNS rebinding. 5. Validate every redirect destination using the same rules and enforce a low redirect limit. 6. Explicitly block cloud metadata endpoints and common metadata hostnames. 7. Prefer an allowlist of trusted domains when the workflow permits it. 8. Require explicit user confirmation before accessing a new or untrusted domain. 9. Apply strict connection timeouts, response-size limits, and content-type restrictions. 10. Ensure fetch requests do not automatically forward ambient credentials, cookies, authorization headers, or client certificates. 11. Treat fetched content as untrusted data and prevent it from issuing tool instructions or overriding the pipeline workflow. 12. Avoid persisting raw sensitive responses; redact secrets and internal identifiers before writing research or queue files. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14
• Finding: Excessive Shell and Sub-Agent Tool Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-22 **Vulnerability Type**: Violation of least privilege through unnecessary high-impact tools **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: - Read - Write - Edit - Bash - Grep - Glob - Agent - AskUserQuestion ``` ### Technical Analysis The skill authorizes unrestricted `Bash` execution and sub-agent delegation through `Agent`, although the documented content-pipeline workflow does not identify a legitimate need for shell command execution. Its stated operations primarily require bounded file access, content search or retrieval, and user interaction. Granting capabilities beyond the workflow's minimum requirements increases the consequences of mistakes and indirect prompt injection. In particular, content obtained from a user-supplied URL is untrusted. If an agent interprets instructions embedded in fetched content as actionable, the unnecessary `Bash` permission may provide a local command-execution channel, while `Agent` may allow unsafe delegation with broader or less predictable behavior. This finding concerns excessive authorization. The audited file does not contain an explicit instruction to execute attacker-provided shell commands, and no malicious script is included in the project. ### Attack Path 1. An attacker supplies a topic, idea, or URL containing adversarial instructions. 2. The skill processes that attacker-controlled content during research, ideation, or drafting. 3. The adversarial content attempts to influence the agent into performing actions unrelated to the content pipeline. 4. Because `Bash` and `Agent` are pre-authorized, a susceptible agent may invoke shell commands or delegate the task instead of remaining within bounded content-processing operations. 5. Any resulting action executes with the permissions available to the agent runtime. This path requires the agent to mishandle untrusted content or otherwise select an ...[truncated 767 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `Bash` from `allowed-tools` unless a specific, reviewed operation requires shell execution. 2. Remove `Agent` unless sub-agent delegation is essential to a documented pipeline stage. 3. Retain only the minimum tools required for the workflow, such as bounded read/write operations, search or fetch functionality, and user confirmation. 4. Restrict file operations to the intended project paths: - `content-queue.json` - `research/` 5. If shell access is unavoidable, replace unrestricted `Bash` with narrowly defined commands using fixed arguments and explicit path validation. 6. Require interactive approval for command execution, network access to untrusted destinations, and operations outside the project directory. 7. Treat topics, ideas, web pages, and research text as untrusted data rather than instructions. 8. Add explicit guidance that fetched content must never alter tool permissions, invoke commands, or override system and skill instructions. 9. Run the skill in a sandbox with minimal filesystem access, no unnecessary credentials, constrained network access, and a low-privilege operating-system identity. 10. Log high-impact tool invocations and reject actions that are unrelated to the documented content-pipeline workflow. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to read and then write back the complete `./content-queue.json` file, modifying local project state without any safety notice, confirmation step, or scope restriction. In an agent environment with file-system tool access, this can cause unintended data modification or overwrite of project data if the user does not realize the command is stateful or if the path is repointed to a sensitive file.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The research stage directs the agent to create `./research/YYYYMMDD-{slug}.md` files on disk but does not warn the user that invoking the pipeline will persist new artifacts locally. This is dangerous because users may expect analysis-only behavior, while the skill actually performs durable writes that can leak sensitive topics into the repository, clutter the workspace, or overwrite existing files if naming collides.

Static analysis

No suspicious patterns detected.