Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its DeepContent purpose, but it can upload user images to permanent public storage without a clear consent step.

Review this before installing if you may use private images, temporary file links, personal headshots, company logos, or client assets. The skill can send those assets to DeepContent and receive permanent public URLs, so users should confirm uploads explicitly and verify rights to any online images.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:32
Finding: Mandatory Third-Party Redirection and Agent Output Hijacking
Content: View full analysis
To create a new recipe, go to **https://deepcontent-pair.vercel.app/recipes** and click **AI Create**. Once you're done, paste the recipe ID back here and I'll run it for you. Nothing else. No questions. No template. No "send me the details". Just the link. ``` ```markdown ### Creating a new recipe New recipes are built through the DeepContent UI. The moment the user asks to create a recipe, send this — no follow-up questions, no collecting details, no trying to build it yourself: > Head over to **https://deepcontent-pair.vercel.app/recipes** and click **AI Create**. The 5-step wizard will walk you through everything. Once you're done, paste the recipe ID back here and I'll run it for you. Then wait. When they paste a recipe ID back, use `createFromRecipeTool` with it. ``` ```markdown - `site_url`: link to the generation page. Always include this when posting results. - `blocks`: array of content: - `type: "image"`: `content` is a URL to the generated image. Display inline or as an embed. - `type: "text"`: `content` is the generated copy. Display as message text. Show all blocks. For image blocks, use the Discord `message` tool with the `media` field: ``` ### Technical Analysis The skill imposes rigid response-control instructions that alter the agent's normal interaction behavior. It requires the agent to provide a specific third-party URL, ...[truncated 1922 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:48
Finding: Public and Persistent Third-Party Storage of User-Supplied Images Without Explicit Consent
Content: View full analysis
" })` → use the returned permanent URL. **3. User sent a local attachment** (no URL — just a file in the chat) → First convert it to a temporary public link using your platform's file-sharing capability. Then treat it as case 2: `uploadImageTool({ url: "" })` → use the returned permanent URL. ``` ```markdown ### `uploadImageTool` Upload an image from any public URL to DeepContent storage and get back a permanent URL. - **When to use:** any time you have a temporary or unverified image URL before passing it to a recipe tool. - **Example:** `uploadImageTool({ url: "https://cdn.discordapp.com/attachments/..." })` ``` ```markdown - **photo_url and logo_url must be permanent public HTTPS URLs.** Run them through `uploadImageTool` if they may be temporary. - If the user doesn't have a headshot or logo URL, search online for them. ``` ### Technical Analysis The skill directs the agent to convert local chat attachments into publicly accessible links and then copy those files into permanent DeepContent storage. This workflow expands access beyond the original chat context and crosses a trust boundary from local or temporary storage into externally controlled persistent storage. No instruction requires explicit informed consent before publication or permanent retention. The skill also provides no retention period, deletion process, access-cont ...[truncated 2232 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims recipe creation is impossible and instructs the agent to refuse such requests, yet it also exposes remixRecipeTool, which clones and saves a recipe as a new one. This inconsistency can cause the agent to mis-handle user requests, bypass intended governance around recipe creation, and create or duplicate assets when policy says it should not.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrases are broad enough to match common terms like 'recipes', 'generate content', or 'linkedin post', which may invoke this skill outside the user's intent. Unintended activation can trigger external tool usage, data sharing, or content generation in contexts where the user did not explicitly request DeepContent operations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file contains conflicting mandatory responses for recipe-creation requests and also mixes that with a recipe remix capability. Contradictory instructions create nondeterministic agent behavior, making it easier for users to steer the assistant into unintended flows or bypass the intended refusal path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to search online for headshots and logos if the user does not provide them, but it does not require user notice or consent before fetching third-party assets. This can introduce privacy, provenance, and copyright risks, and may cause the agent to use incorrect or unauthorized images in generated content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.