Content Creator Workflow

• Outcome: Review
• Latest audit: Jun 19, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

The skill’s WhatsApp image workflow is coherent, but it needs Review because it can process customer messages through third-party AI services and appears to store a WhatsApp token locally in plaintext.

Review this skill before installing. Only use it if you are comfortable sending customer WhatsApp text and voice-note content to external AI and messaging providers, and consider changing the token storage to an OS secret manager or a permission-restricted file with clear operator warning. Pin dependencies to reviewed versions before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares powerful operational capabilities in metadata and usage instructions—environment access, file read/write, network access, and shell execution—but does not expose an explicit permissions model for users or operators. This creates a transparency and governance gap: a user may invoke a workflow that can access secrets, send data externally, and write files without clear prior disclosure or policy constraints.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The description uses broad automation language like 'automate end-to-end request-to-image delivery' without clear trigger boundaries, approval gates, or limits on which messages should be processed. In a messaging-integrated skill, this increases the risk of overbroad invocation, unintended processing of unrelated customer content, or autonomous actions taken without sufficient user review.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The workflow handles customer WhatsApp text and voice notes, transmits audio/text to external OpenAI APIs for transcription and image generation, and sends outputs back through a messaging system, but the skill text does not warn users that third-party services will receive customer content. Because the content may include sensitive personal or business information, the lack of disclosure and consent guidance creates substantial privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The authentication token is persisted in plaintext JSON under the user's home directory without any permission hardening, encryption, or warning. If the local system is shared, compromised, or backed up insecurely, the token could be recovered and used to access the WhatsApp service account.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This creates supply-chain and reproducibility risk because a later release could introduce a breaking change or a newly disclosed vulnerability into the workflow without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: Using an unpinned pydub version permits installation of any newer release that satisfies the minimum version. That weakens build reproducibility and increases supply-chain exposure if an upstream release becomes compromised or introduces security regressions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 98% confidence
• Finding: The unpinned requests dependency is riskier in this skill because requests handles outbound network communication for customer-driven content workflows. Allowing any future compatible version increases the chance of silently pulling a vulnerable or behavior-changing release that could affect credential handling, redirects, TLS verification, or request parsing.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 93% confidence
• Finding: An unpinned python-dotenv dependency allows arbitrary newer versions to be installed, reducing reproducibility and potentially introducing vulnerable behavior into configuration handling. While lower impact than network-facing libraries, it still contributes to supply-chain risk.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The file permits installation of requests versions affected by multiple advisories, and the package is central to a workflow that likely makes HTTP requests to external services based on user input. In that context, known issues such as credential leakage, redirect handling, or certificate verification flaws can have real impact on API secrets, customer data, and integrity of outbound communications.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: The reported python-dotenv advisory concerns symlink following in set_key leading to arbitrary file overwrite in affected versions. This is lower risk here because requirements.txt alone does not prove the vulnerable function is used, but the dependency range could still allow installation of an affected version, so the exposure is plausible.

Static analysis

No suspicious patterns detected.