Social Media Content Planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 0.1.2

Overview

The skill is a coherent content-planning workflow, but it defaults client planning spreadsheets to anonymous link-based edit access and gives only weak guidance for sensitive inputs and API keys.

Review before installing. Use restricted Google Sheet sharing with named users or managed groups instead of anyone-with-link edit access, avoid putting confidential source materials into the workflow unless authorized, and provide API keys through environment or secret configuration rather than pasting them into conversation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:115

Finding

Anonymous Edit Access Exposes Client Planning Data to Unauthorized Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:115
Vulnerability Type: Improper access control and excessive sharing permissions
Risk Level: High

Complete Snippet:

markdown

Share the sheet with edit access (anyone with the link). Report the sheet URL to the human manager.

Technical Analysis

The skill explicitly instructs the agent to grant edit access to anyone possessing the spreadsheet link. This bypasses identity-based authorization and violates least-privilege principles.

The spreadsheet is the project's single source of truth and stores client configuration, target-audience details, competitor information, off-limits topics, research, approvals, content plans, and publishing schedules. An anonymous editor can read or alter this information without authenticating as an authorized stakeholder.

The integrity risk is amplified because subsequent phases and production agents are instructed to consume data directly from the spreadsheet. An unauthorized editor could therefore poison topic approval states, replace titles and hooks, change publishing dates, or inject attacker-selected content into the production workflow.

Attack Path

1. The agent creates the client spreadsheet and enables “anyone with the link” edit access.
2. The URL is exposed through a forwarded message, shared conversation, browser history, application log, or accidental disclosure.
3. An unauthorized party opens the URL without authenticating as an approved collaborator.
4. The party reads confidential strategy or modifies approved topics, calendar entries, status fields, and production instructions.
5. A manager or production agent trusts the spreadsheet as the single source of truth.
6. The unauthorized changes are incorporated into the client's content workflow or published output.

Impact Assessment

An attacker who obtains the URL receives anonymous read and write privileges over the complete spreadsheet ...[truncated 518 chars]

Remediation

View remediation

Remediation Suggestions

• Keep spreadsheets restricted by default and grant access only to explicitly named Google accounts or managed groups.
• Assign the minimum necessary role: viewer for consumers, commenter for reviewers, and editor only for personnel who must modify the plan.
• Require explicit, informed client approval before enabling any form of link sharing.
• If link sharing is unavoidable, avoid anonymous edit access and use an organization-restricted or authenticated sharing policy.
• Separate sensitive client configuration from broadly shared production calendars when different audiences require different privileges.
• Review the spreadsheet's access-control list during each monthly cycle and promptly revoke obsolete collaborators.
• Use revision history, protected ranges, and notifications to detect and recover from unauthorized changes.
• Validate approval statuses and critical calendar fields against authenticated manager confirmation before production handoff.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:384

Finding

API Key May Be Exposed Through Conversational Input and Session Retention

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:384-388
Vulnerability Type: Insecure secret handling
Risk Level: Medium

Complete Snippet:

markdown

1. Go to [Google Cloud Console](https://console.cloud.google.com)
2. Create or select a project
3. Enable "YouTube Data API v3"
4. Create credentials → API Key
5. Add the key as `YOUTUBE_DATA_API_KEY` in your environment or pass it to the agent at session start

Technical Analysis

The environment-variable option is appropriate when securely configured, but the alternative instruction to pass the API key to the agent at session start encourages placing a credential directly into conversational input.

Secrets submitted through conversation may be retained in transcripts, provider telemetry, debugging records, exports, shared session history, or application logs. The skill provides no accompanying instruction to redact the key, disable retention, prevent echoing, or delete credential-bearing messages. API keys are bearer credentials, so possession may be sufficient to invoke APIs allowed by the key's configuration.

Attack Path

1. A user creates a YouTube Data API key.
2. Following the documented alternative, the user pastes the key into the agent conversation at session start.
3. The credential is retained in conversation history, logs, telemetry, an exported transcript, or another session record.
4. A party with access to one of those records extracts the plaintext key.
5. The party uses the key against APIs and resources permitted by its Google Cloud restrictions.
6. The attacker consumes quota or generates charges where applicable until the key is restricted, rotated, or revoked.

Impact Assessment

Exploitation grants the attacker the same API-level capabilities permitted to the exposed key. For a properly restricted YouTube-only key, the likely impact is unauthorized API usage and quota exhaustion. If the key is insufficiently ...[truncated 330 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction permitting users to pass API keys through conversation.
• Require injection through a secret manager, protected runtime configuration, or securely managed environment variable.
• Ensure the agent never displays, repeats, persists, or writes credentials into spreadsheets or other artifacts.
• Apply Google Cloud API restrictions so the key can access only the YouTube Data API.
• Apply application restrictions based on the deployment model, such as server IP restrictions where feasible.
• Configure quota limits and monitoring alerts for unexpected API usage.
• Redact secrets from application logs, traces, telemetry, error reports, and transcript exports.
• Immediately rotate and revoke any key previously pasted into a conversation or otherwise exposed.
• Prefer short-lived or brokered credentials when the deployment platform supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs the agent to share the planning spreadsheet with edit access to anyone holding the link, which exposes client configuration, strategy, competitor references, and future content plans to unauthorized viewing and modification. Because the spreadsheet is the system of record and later handed off to other agents, link leakage or accidental forwarding could lead to data exposure, tampering, or downstream misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill invites ingestion of ebooks, transcripts, recordings, uploaded files, and URLs without any safeguards, warnings, or filtering for sensitive information. In practice, these materials may contain confidential business data, personal data, meeting secrets, or third-party copyrighted/private content, which could then be stored in research tabs, summarized, or propagated to external services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.