Security audit

Chief Editor Desicion

Security checks for vulnerabilities and agentic risk

Overview

This skill is a report-writing helper, but it requires broad attachment reading, URL scraping, and detailed document submission without enough user control or data-handling limits.

Install only if you are comfortable with the skill reading every provided attachment, visiting URLs discovered inside those attachments, and producing/submitting a detailed report. Avoid using it with confidential documents, internal URLs, secrets, private research logs, or personal data unless the workflow adds explicit review, redaction, and URL-approval controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The instructions require the agent to read all attachments and scrape URLs found within them, yet provide no user-facing disclosure, consent flow, or data-handling boundaries for external access. In practice, this can leak sensitive document-derived context to third-party sites, trigger requests to attacker-controlled URLs, or process confidential material in ways the user did not expect.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill instructs the agent to provide the 'entire closed loop' of reasoning, include all obtainable details, cite source URLs from attachments, and avoid omission, which strongly pressures disclosure of sensitive source content in natural language. Combined with mandatory report creation and submission, this can exfiltrate confidential attachment contents, embedded URLs, internal research logs, or proprietary data into durable outputs.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest presents the skill as a narrow 'chief editor decision' capability, but the body grants broad operational behavior: reading all attachments, scraping external URLs, generating documents, and submitting results. This mismatch reduces transparency and can cause users or orchestrators to invoke the skill without understanding that it performs expansive data access and outbound content retrieval.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill is described in broad, generic terms and lacks concrete activation constraints, so it can be invoked in contexts far beyond a narrowly defined editorial workflow. Over-broad prompting increases the chance of misuse, prompt injection propagation from supplied materials, and accidental execution of unnecessary high-risk actions such as bulk reading and reporting.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill makes URL scraping mandatory whenever URLs are found in attachments, without demonstrating that such access is necessary for every chief-editor decision task. This creates an unjustified expansion from local document review to external network access, increasing the chance of unintended data exposure, SSRF-like access to sensitive endpoints via tools, or retrieval of untrusted content.

Static analysis

No suspicious patterns detected.