Generate Executive Recruiting Boutique Client Education Handout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:28 AM UTC
• Version: 1.0.0

Overview

This handout-writing skill has no malicious payload, but it requests shell and local-file access that is not justified by its content-generation purpose.

Before installing, consider whether this skill really needs access to run shell commands or read local files. A safer version would remove Bash and Read, or clearly limit them to explicit user-selected inputs and require confirmation before any local access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Shell and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code Snippet:

yaml

---
name: Generate Executive Recruiting Boutique Client Education Handout
description: "Create a polished explainer handout with visuals, FAQs, and clear next steps for a executive recruiting firm. Use when handling client education work..."
allowed-tools: Bash, Read
metadata:

Technical Analysis

The Skill is intended to generate and refine an executive recruiting client-education handout. Its documented workflow does not require shell command execution or access to arbitrary local files. Nevertheless, the allowed-tools configuration grants access to both Bash and Read.

Bash can execute commands with the privileges of the Agent process, while Read can access files available to that process. Granting these capabilities without a documented operational requirement violates the principle of least privilege and unnecessarily expands the Skill's attack surface.

Although the reviewed file contains no malicious commands, payloads, persistence mechanisms, or explicit data-exfiltration instructions, malicious or attacker-controlled prompt content could potentially influence the Agent into using these unnecessary tools.

Attack Path

1. A user or external content supplies attacker-controlled instructions while this Skill is active.
2. The content induces the Agent to perform an operation presented as necessary for generating the handout.
3. The Agent invokes the unnecessarily authorized Read tool to access local files or Bash to run shell commands.
4. Commands execute with the Agent process's operating-system privileges, or readable local information is exposed through the generated response.
5. The resulting impact depends on the filesystem access, credentials, environment variables, network acce ...[truncated 863 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash and Read from allowed-tools because the documented handout-generation workflow does not require shell or filesystem access.
2. Authorize only narrowly scoped tools needed to generate text and visuals.
3. If file input later becomes necessary, replace unrestricted reading with a scoped mechanism limited to explicitly selected workspace files and approved file types.
4. If command execution later becomes essential, use a restricted command allowlist, argument validation, an isolated sandbox, a read-only filesystem where possible, and disabled network access by default.
5. Require explicit user approval before accessing local information or executing commands.
6. Add automated policy checks that reject Skill manifests requesting tools not justified by their documented workflows.
7. Log and review sensitive tool invocations so unexpected file access or command execution can be detected.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "Use when handling client education work..." is vague and broad, with no clear boundaries on what kinds of client education tasks are in scope. This could overlap with many ordinary writing or communication requests and lead to unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

"Use this skill for client education work for executive recruiters, talent partners" does not define the exact task boundaries, trigger phrases, or non-applicable scenarios. Without clearer scope constraints, the activation guidance may match a wide range of general recruiting-related content tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.