Marketing Drafter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:44 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent AI marketing helper, but it directs users to unaudited external package installs while asking for API keys and business inputs.

Review before installing. Use only pinned, provenance-checked package versions, avoid placing production secrets in this tool, and do not submit real customer records, confidential campaign plans, or regulated data unless you have approved the external AI provider and package implementation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned and Unauditable External Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:49-53, README.md:22-27, README.md:61-71, and package.json:5
Vulnerability Type: Supply-chain risk from mutable external dependencies
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:49-53:

bash

npm install marketing-drafter
# or
pip install marketing-drafter

README.md:22-27:

bash

npm install marketing-drafter
# or
python -m pip install marketing-drafter

README.md:61-71:

bash

npm install marketing-drafter

bash

pip install marketing-drafter

package.json:5:

json

"main": "index.js",

Technical Analysis

The documentation instructs users to install marketing-drafter from the npm or Python package registry without pinning a version or verifying an integrity hash. These commands resolve to mutable, externally hosted packages whose contents are not included in the audited artifact.

The artifact contains only documentation and package metadata. In particular, package.json declares index.js as its entry point, but no such implementation was present in the supplied project structure. There is also no npm lockfile, Python requirements lockfile, integrity metadata, vendored source code, or other mechanism that would allow the installed implementation to be compared with the reviewed artifact.

An unversioned npm installation can execute package lifecycle scripts during installation. Both npm and Python packages can also execute arbitrary code when imported or invoked. The documented examples direct users to provide the installed package with an OpenAI API key, potentially exposing that credential and other process environment data to code that was not available for audit.

This finding does not establish that the current registry packages are malicious. It establishes that following the documented installation procedure crosses an unaudited supply-chain boundary and allows ...[truncated 1914 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the actual implementation in the reviewed repository so its behavior can be audited against the documentation.
2. Confirm ownership and provenance of both the npm and Python registry packages before directing users to install them.
3. Pin exact package versions rather than relying on the latest registry release.
4. Commit appropriate lockfiles, such as package-lock.json for npm and a hash-locked requirements file for Python.
5. Require integrity verification. Use npm lockfile integrity fields and Python hash checking, such as pip install --require-hashes.
6. Publish reproducible build information and signed release artifacts where possible.
7. Ensure the package repository URL, registry metadata, release tags, and source commit are consistently linked and verifiable.
8. Avoid providing API credentials to the installed package until its provenance and implementation have been verified.
9. Run package installation and content generation under a dedicated, least-privileged account or isolated container with restricted filesystem and network access.
10. In CI environments, expose only narrowly scoped, short-lived credentials and prevent untrusted installation scripts from accessing production secrets.
11. Add the referenced index.js implementation or correct the package entry point so the distributed artifact is complete and independently reviewable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

Setup

bash

export OPENAI_API_KEY=sk-...
# or set in .env file

Configuration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README shows users supplying marketing topics, audiences, and other business inputs to the package while configuring an external model provider API key, but it does not clearly warn that those prompts and any included business data will be transmitted to a third-party AI service. This can cause users to unknowingly send confidential campaign plans, customer information, or proprietary product details outside their environment, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example code includes customer/company-style records in existingCustomers without any warning to avoid using real sensitive, proprietary, or regulated data in prompts. In a marketing skill, users are especially likely to paste actual customer lists, industries, deal context, or internal sales data, which could then be exposed to an external model provider or retained in logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This is a markdown file, so missing-warning review applies to the documentation text. The example shows use of an API key and implied transmission of prompt content to an external model service, but the skill description does not disclose privacy or data-handling implications to users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.