Social Media Content Calendar

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:35 PM UTC
• Version: 1.0.0

Overview

The skill is useful for creating social media calendars, but it requests broad shell access that its documented workflow does not need.

Install only if you are comfortable granting the skill broad local command authority in addition to normal file generation. Prefer a version that removes Bash and asks before overwriting files in output/content-calendar/.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary Shell Access Violates Least-Privilege Principles

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable Code Snippet:

yaml

---
name: social-media-content-calendar
description: Generate structured social media content calendars with platform-specific posts, hashtags, and scheduling. Use when creating social media plans, content calendars, or social media management deliverables for clients.
argument-hint: "[niche-or-brand] [platforms] [timeframe]"
allowed-tools: Read, Write, Edit, Grep, Glob, Bash, WebSearch
---

Technical Analysis

The skill grants access to the Bash tool, although its documented function is limited to generating social-media content calendars and writing the resulting Markdown and CSV files. The documented workflow does not identify any operation that requires arbitrary shell-command execution.

Granting a general-purpose command interpreter expands the skill's authority beyond its legitimate requirements and violates the principle of least privilege. Unlike narrowly scoped file tools, shell access can potentially invoke local executables, read files available to the runtime identity, alter files, launch processes, or initiate network operations where the environment permits them.

The configuration does not itself execute a malicious command, and no embedded payload was found. Exploitation therefore depends on the agent being induced to misuse the authorized tool, such as through adversarial user input or untrusted content encountered during web research.

Attack Path

1. An attacker supplies a maliciously crafted brand brief, platform value, or other skill argument, or causes adversarial instructions to appear in web content used for hashtag research.
2. The agent interprets those instructions as requiring a local command rather than treating them strictly as untrusted content.
3. Because Bash is explicitly allowed, the agent invokes a ...[truncated 931 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash from allowed-tools because no documented calendar-generation operation requires shell execution:

   yaml

   allowed-tools: Read, Write, Edit, Grep, Glob, WebSearch
   

2. Consider reducing permissions further. If the skill only creates deliverables in output/content-calendar/, authorize only the minimum file-reading and file-writing operations needed for that directory.

3. Restrict all generated files to a dedicated output directory and reject absolute paths, parent-directory traversal, and symbolic-link escapes.

4. Retain WebSearch only if current hashtag research is required. Treat search results as untrusted data and prohibit instructions found in retrieved content from changing tool usage or the skill's workflow.

5. If shell execution becomes necessary in a future version, replace unrestricted shell access with a narrowly scoped helper or command allowlist. Run it in a sandbox with a minimal environment, restricted filesystem access, no unnecessary credentials, and disabled network access unless explicitly required.

6. Add a security test that verifies the skill cannot invoke arbitrary commands and cannot write outside output/content-calendar/.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to generate and write multiple files under output/content-calendar/ without any requirement to notify the user first or obtain confirmation. While the writes are limited to a relatively narrow output directory and align with the skill's stated purpose, silent multi-file creation can still surprise users, overwrite prior work, or create unintended artifacts in the workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.