copywriting-prose-creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.2.0

Overview

This skill mostly does what it says, but its audit workflow can expose private writing samples to third-party readability websites without a clear consent step.

Review before installing if you plan to audit private or unpublished content. For sensitive corpora, instruct the agent to keep analysis local and not paste text into Hemingway, Datayze, WebFX, Grammarly, LanguageTool web, or similar third-party tools unless you explicitly approve the exact destination and text sample.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/audit-tools.md:9
• Finding: Potential Disclosure of Confidential Corpus Content to Third-Party Web Services## Vulnerability Details **File Location**: `references/audit-tools.md`, lines 9–29 **Vulnerability Type**: Uncontrolled transmission of potentially sensitive content to an external service **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ### Hemingway Editor Browser tool at hemingwayapp.com (or the desktop / pasteable web version). Highlights: - Sentences hard to read (yellow) and very hard (red) - Passive voice - Adverbs - Complex phrases ("utilize" → "use") - Reading grade level **Usage**: paste 1000 words. Read off the grade level. Targets per category: | Category | Target grade | | -------------------- | ------------ | | B2C / consumer brand | 6–9 | | B2B SaaS | 9–12 | | NGO / nonprofit | 7–10 | | Industry / deep-tech | 12–16 | | Consulting | 11–14 | ``` The same file also recommends additional external readability services at lines 165–171: ```markdown ## Web-based readability tests For a quick sanity check without local tooling: - **Hemingway Editor** (hemingwayapp.com) — grade level, complex sentences, passive voice, adverbs - **Datayze Sentence Length Checker** (datayze.com/sentence-length-checker) — distribution histogram - **WebFX Readability Test** (webfx.com/tools/read-able) — multiple readability scores ``` ### Technical Analysis The Skill instructs users or agents to paste 1,000 words of a content corpus into a third-party website. The corpus accepted by the Skill may contain unpublished content, ghostwritten material, internal operational information, regulated claims, or other confidential text. Although `references/discovery-questions.md` asks about confidentiality constraints, the external-tool workflow does not require the agent to apply those constraints before transmitting data. This is an insecure data-handling practice because it lacks: - Explicit user authorization fo ...[truncated 2346 chars]
• Remediation: ## Remediation Suggestions 1. **Make local analysis the default.** Use local readability formulas and the included Python tooling rather than web-based services. 2. **Add a mandatory data-classification gate.** Before external processing, classify the selected material as public, internal, confidential, regulated, or personal. 3. **Prohibit sensitive submissions.** Explicitly forbid uploading unpublished, confidential, personal, customer-related, legally privileged, or regulated content to third-party tools. 4. **Require destination-specific consent.** Obtain explicit user approval that identifies the service, the exact text to be transmitted, and the purpose of transmission. 5. **Minimize and redact data.** Remove names, identifiers, customer information, proprietary figures, and unnecessary context. Submit only the smallest sample needed. 6. **Document third-party risks.** Warn that external services may log, process, or retain submitted text under their own privacy and retention policies. 7. **Support self-hosted alternatives.** Recommend local or self-hosted LanguageTool, Vale, and readability libraries for sensitive corpora. 8. **Restrict network tools by mode.** Avoid granting or using `WebFetch` and `WebSearch` during local corpus analysis unless external research is explicitly requested and approved. 9. **Enforce fail-closed behavior.** If sensitivity or authorization is unclear, keep all corpus processing local.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The instruction to invoke `samber/cc-skills@humaniseur-fr` "for French" introduces a locale-specific skill selection in natural-language guidance. The file does not state that the user should choose or opt into French-language handling, so this can be read as enforcing a language-specific workflow rather than offering a neutral language choice.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Split the article's arguments across N emails — one argument per email.
2. Each email opens with a hook that pulls forward from the previous one.
3. Closing of each email teases the next (curiosity gap, open loop).
4. Final email contains the primary CTA. Earlier emails build trust without asking.
5. Maintain consistent sender voice across the sequence — drip sequences live on continuity.

## Cross-channel transformation rules (other directions)

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The guidance sets 'Hexagonal French' as the default for France-based brands and instructs authors to 'Declare which variant,' but it does not offer an explicit user or stakeholder opt-in process before applying that locale default. This can create a language/locale policy issue because the file prescribes a regional language variant by default rather than requiring selection based on audience preference.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file describes producing `PROSE.md` as the output artifact and later also `AUDIT-MEMO.md`, which means the skill affects the user's workspace. While the behavior is central to the skill, the description does not explicitly warn users that running the skill will create or update files in the working directory.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The statement "For UK English specifically" imposes a locale-specific constraint in natural language. The file does not present this as an optional choice or clearly justify it as a region-specific compliance requirement, so it fits the language/locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The template includes "[English variant (US/UK/intl)...]" as a policy element, which can lead downstream skill authors to prescribe a locale or language variant by default. Because the template does not require opt-in, user choice, or a region-specific justification, it risks encouraging locale constraints that violate the stated language/locale policy guidance.

Static analysis

No suspicious patterns detected.