Creative Officer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.2

Overview

The skill is mainly a marketing and creative-planning guide, but it requests broad file and command permissions that are not clearly needed or bounded.

Review before installing. Use this skill only in a sandbox or with exec disabled unless you explicitly need host commands. Avoid giving it access to sensitive files or credentials, and require confirmation before any file write, external API call, package installation, or system command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:37

Finding

Unnecessary Command Execution and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37-40
Vulnerability Type: Excessive agent tool permissions
Risk Level: High

yaml

tools:
- read
- exec
- write

Technical Analysis

The Skill requests unrestricted command-execution and filesystem read/write tools even though its documented core behavior is Markdown-based creative guidance and does not require command-line execution. Granting these capabilities violates the principle of least privilege.

The exec capability creates a system command-execution channel, while read and write can expose or modify files accessible to the hosting Agent. The document mentions command allowlisting as a recommendation, but it does not define or enforce an allowlist, path restrictions, argument validation, or user confirmation requirements.

No explicit malicious command is present in the reviewed file. Exploitation would therefore depend on the Agent invoking these unnecessary capabilities in response to hostile user input, untrusted content, or prompt injection.

Attack Path

1. The Skill is loaded with the declared read, write, and exec permissions.
2. The Agent processes attacker-controlled input or content containing instructions to use one of those tools.
3. Because no enforceable command allowlist or filesystem boundary is defined, the Agent may invoke a command or access a file unrelated to creative-management tasks.
4. The operation executes with the permissions of the Agent process.
5. Depending on host permissions, the attacker may cause unauthorized disclosure, file modification, or command execution.

Impact Assessment

Successful exploitation could allow access to files available to the Agent process, modification of writable project or configuration files, and execution of local commands. The precise scope is bounded by the sandbox and operating-system privileges of the hosting Agent. In a weakly isolated environment, this c ...[truncated 106 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec, read, and write from the declared tools when the Skill is used solely for natural-language creative guidance.
• If file access is necessary, separate it into an explicit workflow and restrict operations to a dedicated workspace directory.
• Prefer purpose-specific APIs over general filesystem and shell tools.
• If command execution is unavoidable, enforce a strict executable and argument allowlist outside the prompt layer.
• Prohibit shell interpretation, command concatenation, redirection, environment expansion, and attacker-controlled executable paths.
• Require explicit user confirmation before commands or sensitive file operations.
• Run the Skill in a sandbox with a read-only filesystem where possible, no access to secrets, no unnecessary network access, and a low-privilege operating-system identity.
• Add tests verifying that creative-management requests cannot trigger unrelated command execution or filesystem access.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:469

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:469
Vulnerability Type: Unpinned package installation
Risk Level: Medium

shell

pip install pyyaml

Technical Analysis

The setup guidance installs PyYAML without specifying an audited version or integrity hash. Package resolution is therefore mutable: different executions can install different releases without any corresponding change to the reviewed Skill.

Installing a Python package may execute package build or installation logic and introduces code that may later be imported into the runtime. An unpinned installation creates supply-chain exposure if the package source, a future release, the configured package index, or the dependency-resolution path is compromised.

PyYAML is named correctly and no malicious repository is specified, so there is no evidence that the project deliberately introduces a malicious dependency. The issue is the absence of reproducible version and integrity controls.

Attack Path

1. An operator follows the dependency setup instruction.
2. pip queries the currently configured package index and resolves the latest compatible PyYAML distribution.
3. A release or distribution supplied through a compromised package account, index, mirror, or network configuration is selected.
4. The package is downloaded and installed without comparison against a project-approved hash.
5. Malicious installation logic or subsequently imported package code runs with the privileges of the Python or Agent environment.

Impact Assessment

A compromised dependency could execute code with the installer’s privileges, access environment variables and files available to that process, modify the Python environment, or interfere with later Agent operations. The scope depends on the installation account, virtual-environment isolation, network access, and filesystem permissions.

Remediation

View remediation

Remediation Suggestions

• Remove the dependency instruction if PyYAML is not required by an included implementation.
• If it is required, pin an audited exact version rather than resolving the latest release.
• Maintain dependencies in a lockfile or requirements file containing cryptographic hashes.
• Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
• Use a trusted package index and prevent unapproved extra indexes or mirrors.
• Perform installation in an isolated virtual environment or container under a non-privileged identity.
• Scan pinned packages and transitive dependencies for known vulnerabilities and review version updates before adoption.
• Avoid installing dependencies automatically merely because the Skill is loaded.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill whenever the user needs marketing promotion, advertising, customer acquisition, growth, or similar outcomes, which is a very wide trigger scope. It does not provide clear boundaries or negative examples beyond excluding illegal marketing, so many ordinary business requests could unintentionally invoke this skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation says the skill relies only on built-in LLM functionality and public information with no extra API keys, but later claims external API integration. That mismatch obscures whether data may be sent to third parties and whether additional credentials, network access, or trust boundaries are involved.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill presents itself as a pure Markdown instruction set whose core functionality does not require exec, yet elsewhere advertises command execution. This inconsistency can mislead reviewers and users about the true privilege and attack surface of the skill, increasing the risk that execution-capable tooling is enabled without appropriate scrutiny.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly documents system command execution even though its stated purpose is creative direction, brand planning, and marketing workflow support. Unnecessary exec access materially expands the attack surface, because prompt injection or ambiguous instructions could turn a content-generation skill into one that reads, modifies, or executes on the host environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes file writing, external API use, and command execution but does not clearly warn users about filesystem changes, network transmission, or host-side effects. Missing disclosure and confirmation around state-changing actions raises the risk of unintended modification, data leakage, or unsafe execution under normal-looking creative prompts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill claims external API integration without clearly tying that capability to the described creative-planning use case. Even if benign, unnecessary outbound network capability can expose user content, internal prompts, or derived business data to third-party services without clear disclosure.

Content

No source excerpt is available for this finding.