Security audit

content-analytics

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent with content analytics, but it also has broad database-write, cross-tenant sync, external tool, and persistent learning behavior that should be reviewed before installation.

Install only in an environment where this skill is allowed to modify PostgreSQL content analytics tables, access tenant publishing records, run Docker/opencli/Python subprocesses, and persist derived lessons. Confirm tenant isolation, approval for scheduled or full-loop runs, and whether learned performance data may be reused in future content generation.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares powerful execution capabilities (exec, read) and explicitly depends on environment variables, file reads, and shell/Python execution, but there is no clear permission model or scope restriction documented for those actions. In practice this can let a content-analysis skill access local files, secrets, or execute commands beyond its stated purpose, increasing the blast radius if the skill is misused or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as analytics/reporting, but the documented behavior expands into operational workflows: database schema changes, writes back into PostgreSQL, admin-mode synchronization from tenant_publish_records, friend recommendation, subprocess calls to external tooling, and persistence of learned lessons. This description-behavior mismatch is dangerous because users or orchestrators may grant or invoke the skill under the assumption of read-mostly analytics, while it actually has broad write, cross-tenant, and external-execution side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: These rules expand an analytics skill into operational actions: scheduled batch processing, report persistence, and CEO notifications based on computed ratings. That scope creep is dangerous because an analytics-only capability can start triggering workflow side effects and storing outputs in memory paths without an explicit user action or tighter authorization boundaries.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The business rules broaden the skill from retrospective content analytics into publish-time optimization and lifecycle management for evergreen content. This increases risk because the skill can influence future publishing decisions and persistent content strategy beyond its stated analytics scope, creating hidden capabilities that may be invoked without clear user expectation or review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill launches an external self-growth engine and sends it derived lesson text containing title, platform, performance metrics, and tenant context. In a multi-tenant analytics skill, this creates an unnecessary cross-component data flow and expands trust boundaries; if the external engine is compromised, misconfigured, or stores data insecurely, sensitive tenant analytics and behavioral data may leak or be reused outside the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.