Security audit

Create Business Plan

Security checks across malware telemetry and agentic risk

Overview

This business-plan skill is mostly purpose-aligned, but it asks the agent to persistently modify the skill itself after normal use and has broad triggers that could activate it unintentionally.

Review this skill before installing if you do not want skills to change their own instructions over time. It is appropriate for structured business-plan work, but users should require explicit approval before any SKILL.md edits, narrow the triggers, and avoid letting feedback or project memory become persistent instructions without review.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to read cross-session memory and directly modify its own SKILL.md after normal task completion, which exceeds the scope of a business-plan methodology and creates persistent prompt/state poisoning risk. If a user or prior session injects bad guidance into memory or feedback, the skill can silently entrench unsafe behavior across future runs.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill establishes an approval-before-editing principle for BP files, but later requires direct edits to SKILL.md after each use without the same approval gate. That inconsistency weakens user expectations around file safety and can normalize silent edits to persistent instruction files, increasing the chance of unauthorized or unnoticed behavior changes.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The auto-load trigger is broad enough to activate on many ordinary business-plan-related requests, causing the skill to run when the user did not clearly request it. Over-broad activation increases the blast radius of any unsafe behavior in the skill, especially the persistent-memory and self-editing components, because they may be invoked unintentionally.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase "BP" is highly ambiguous and commonly used in unrelated contexts, so it can cause this skill to activate on generic user requests that were not intended for business-plan generation. This creates scope-collision risk, where the agent may inject specialized planning behavior into conversations without clear user intent, reducing predictability and increasing the chance of inappropriate tool selection.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase "business plan" is broad enough to match many ordinary requests, including high-level discussion or educational questions, rather than explicit invocation of this specific methodology skill. Overbroad matching can lead to unintended activation, user confusion, and excessive privilege or influence by the skill in contexts where a narrower workflow would be more appropriate.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.