Security audit

tw fashion social manager

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for social-media marketing and analytics, but it asks for broad, persistent Meta account credentials and can run local data-fetching code without tight user-scoped controls.

Review before installing. Use a dedicated least-privilege Meta system user or token if possible, avoid granting full-control/admin access unless truly required, keep .env out of source control with restricted permissions, rotate/revoke tokens after use, and run the Python helper only when you explicitly want live account analytics fetched and saved locally. Static scan was clean and VirusTotal was pending; the Review verdict is based on the artifact's credential scope and control boundaries, not on malware evidence.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The README documents a capability to collect Facebook, Instagram, and Threads insights via API credentials and a local script, which materially expands the skill beyond its declared role as a content and ad-strategy advisor. This scope expansion is dangerous because it encourages deployment of privileged data-ingestion functionality under a misleading skill description, increasing the chance that users grant sensitive access they did not expect.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The README instructs users to handle long-lived access tokens and OAuth client secrets even though the skill is presented as a marketing strategy expert, not an integration or admin automation tool. That mismatch makes the request for high-value credentials more dangerous because users may disclose secrets to enable functionality that is not necessary for the advertised purpose.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: These instructions tell the agent to load local META_ environment variables from a .env file and run a Python script that fetches external insights, despite the skill being framed as a strategist using embedded data. This is dangerous because it turns a content-advice skill into a credential-consuming data exfiltration path, with little indication to the end user that local secrets and external APIs are involved.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill claims it can operate from built-in advertising data, but its instructions require package installation and execution of a separate data-retrieval script. This inconsistency is risky because it encourages unanticipated code execution and network activity in contexts where the user likely expects only static guidance, widening the attack surface unnecessarily.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The guide tells users to place long-lived tokens and client secrets into a .env file but provides no warnings about secret storage, file permissions, exclusion from source control, rotation, or leakage risks. This is dangerous because these credentials can grant direct access to business social accounts and analytics if accidentally committed, shared, or exposed through logs and backups.

Vague Triggers

High

Confidence: 88% confidence
Finding: The activation criteria are extremely broad, instructing automatic triggering for a wide range of common social-media or advertising requests. Over-broad activation is dangerous here because the skill also contains instructions for credential loading and script execution, so unnecessary invocation increases the chances of exposing secrets or initiating unintended external actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly instructs reading META_ variables from a local .env file and executing a Python script, but provides no clear user warning that credentials will be accessed. This lack of disclosure is dangerous because secrets may be consumed or transmitted to external APIs without informed consent, violating least surprise and increasing the risk of credential misuse.

Static analysis

No suspicious patterns detected.