首席创意官

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.1

Overview

This skill is mostly a creative-writing guide, but it asks for broad read, write, and command-execution authority without clear limits.

Review before installing. This does not appear to contain a malicious payload, but only install it in a sandbox or with read/write/exec disabled unless you specifically need those powers and can restrict files, commands, callbacks, and API use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:11

Finding

Excessive Tool Permissions Violate the Principle of Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-14
Related Locations: SKILL.md:40, SKILL.md:217-219, SKILL.md:268-269
Vulnerability Type: Excessive filesystem, command-execution, and external-integration capabilities
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

Technical Analysis

The Skill requests unrestricted read, write, and exec tools even though its documented purpose is creative strategy, brand narrative generation, and content review. These activities can ordinarily be completed through language-model processing without arbitrary command execution or filesystem modification.

The requested permissions violate the principle of least privilege:

• read may expose local files unrelated to the creative task.
• write may allow modification or creation of files outside the intended workflow.
• exec may allow execution of operating-system commands with the agent process's privileges.

The risk is reinforced by the declarations at SKILL.md:217-219, which advertise file processing, external API integration, and system-command execution without defining command allowlists, filesystem boundaries, destination restrictions, approval requirements, or sensitive-data handling controls. The optional callback_url parameter at line 40 also introduces a potential attacker-controlled outbound destination, but no validation or callback implementation is provided in the audited artifact.

The document is internally inconsistent: lines 268-269 classify it as a pure Markdown Skill, while lines 11-14 request privileged tools. No executable script or directly malicious command was found, so exploitation depends on a tool-enabled agent following attacker-influenced natural-language input.

Attack Path

1. The Skill is loaded by an agent that grants the declared read, write, and exec tools.
2. An attacker supplies crafted content through the ...[truncated 1632 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write from the tool declaration when the Skill is used only for creative analysis and text generation.
2. If file access is essential, grant access only for a user-selected workspace and restrict operations to explicitly approved file types and paths.
3. Replace general command execution with narrowly scoped, typed operations. If exec cannot be removed, enforce a command and argument allowlist, prohibit shell interpretation, apply strict time and resource limits, and run commands in an isolated sandbox with no secrets or unnecessary network access.
4. Require explicit user confirmation before reading sensitive files, overwriting files, executing commands, or transmitting data externally.
5. Remove callback_url if asynchronous callbacks are not implemented. If callbacks are required, accept only HTTPS destinations from a trusted-domain allowlist, reject redirects and private or link-local addresses, and minimize transmitted data.
6. Define controls against prompt injection from user input and file content. Tool requests should be validated against the declared task rather than followed directly from untrusted natural-language instructions.
7. Reconcile the Skill classification with its actual behavior. A pure Markdown creative Skill should not claim unrestricted file, API, or command-execution capabilities.
8. Add auditable security policy documentation covering permitted paths, permitted commands, outbound destinations, consent requirements, and handling of sensitive information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares read, write, and exec capabilities even though its stated purpose is creative strategy and brand storytelling. This creates unnecessary authority and materially increases the attack surface: a prompt or downstream workflow could cause filesystem changes or command execution unrelated to the advertised function, violating least privilege and enabling abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented behavior drifts from creative strategy into generic automation, file handling, API integration, and command execution. In context, this is especially dangerous because the skill markets itself as a creative assistant, so users may invoke it with lower suspicion while it possesses or implies capabilities suitable for system interaction and broader automation abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation language is so broad—covering efficiency improvement, automation, batch processing, and workflow optimization—that it can match many unrelated requests outside creative strategy. Overbroad routing increases the chance that this skill is selected for tasks where its permissions or behavior are inappropriate, potentially exposing file, execution, or external-action capabilities in the wrong context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation says no extra API key is needed, but elsewhere discusses API authentication failures and token troubleshooting. This inconsistency can mislead users and reviewers about whether the skill makes authenticated external calls, obscuring data-flow and trust boundaries and making risky behavior harder to detect or govern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is described both as MD+EXEC and later as pure Markdown natural-language instructions. This contradiction matters because users and platform controls may rely on the declared execution model to assess risk; ambiguity around whether code/commands run can lead to unsafe deployment, insufficient sandboxing, or mistaken user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Markdown advertises file writing, API calls, and command execution without prominent user-facing warnings about side effects, data exposure, or system impact. This is risky because users may treat the skill as a harmless creative helper while it can perform actions that modify files, contact external services, or run commands, creating consent and safety gaps.

Content

No source excerpt is available for this finding.