Security audit

DeepContent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward DeepContent content-generation helper, with the main caution that it may search public web sources for images and logos when users do not provide asset URLs.

Install only if you are comfortable with the agent using DeepContent MCP tools and potentially searching public websites for missing templates, logos, or headshots. Prefer providing your own approved asset URLs, and review any found images before publishing generated content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation list includes broad phrases like 'generate content', 'create a post', and 'linkedin post', which can cause the skill to trigger in contexts only loosely related to DeepContent. Overbroad invocation increases the chance the agent will enter this skill unexpectedly and follow its riskier instructions, including external asset searches and content-generation actions the user did not specifically intend.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill says to use MCP tools rather than direct HTTP requests, but then instructs the agent to search the web and obtain external asset URLs when required inputs are missing. This creates contradictory behavior that can push the agent to access arbitrary third-party content outside the MCP boundary, weakening trust and increasing the risk of prompt injection, untrusted content ingestion, or policy bypass.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill encourages searching online for speaker headshots and company logos when users do not provide them, but does not require informing the user or obtaining consent first. This can result in unannounced collection of personal or organizational data from third-party sources, with privacy, accuracy, and impersonation risks if the wrong assets are selected.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly directs the agent to search the broader web, including LinkedIn and Twitter, for headshots, logos, and templates that are not necessary to execute the core DeepContent tools. Pulling agent behavior into arbitrary external sites expands the attack surface and exposes the model to malicious or manipulated content, while also creating privacy and provenance concerns around third-party assets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill tells the agent to search online for a suitable template image if the user does not have one, without clearly warning that external content will be sourced. While less sensitive than headshots, this still introduces provenance, copyright, and prompt-injection risk from arbitrary third-party images and may surprise users who expected only first-party tooling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.