Generate Finance Ad Creative Brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:24 AM UTC
• Version: 1.0.0

Overview

The skill is a simple finance ad brief generator, but it asks for unrestricted Bash access that its stated content-planning purpose does not justify.

Review this skill before installing because it grants shell access that is not needed for its stated job. Prefer a version limited to Read or other narrowly scoped content tools, and review any generated ad material before publication.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Unnecessary Bash Permission Violates Least-Privilege Principles

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4
Vulnerability Type: Excessive tool permission
Risk Level: Medium

Vulnerable Code Snippet:

yaml

---
name: Generate Finance Ad Creative Brief
description: "Plan campaign visuals and hooks for finance promotions. Use when working on paid campaign planning for finance teams, analysts, operators."
allowed-tools: Bash, Read
metadata:

Technical Analysis

The skill grants access to the Bash tool even though its documented purpose is limited to creating finance advertising briefs. The workflow describes gathering requirements, drafting content, enriching assets or supporting data, and refining the result. It does not identify any legitimate need to execute operating-system commands.

Granting shell access beyond the requirements of the stated task violates the principle of least privilege. If untrusted campaign content, supporting documents, or user instructions influence the agent, they could potentially induce it to invoke Bash for operations unrelated to brief generation. The finding concerns the exposed permission boundary; the reviewed file does not itself contain a malicious shell command or an instruction to execute one.

Attack Path

1. A user loads the skill, making both Read and Bash available to the agent.
2. The agent processes attacker-controlled or otherwise untrusted campaign requirements or supporting content.
3. That content attempts to persuade or instruct the agent to invoke Bash under the pretext of gathering data, enriching assets, or completing the workflow.
4. If the agent follows the injected instruction and the runtime does not impose additional controls, shell commands execute with the operating-system privileges and filesystem/network access granted to the agent process.
5. The resulting command could access local files, modify workspace data, invoke installed programs, or communicate over the network, subject t ...[truncated 692 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash from allowed-tools because the documented content-generation workflow does not require shell execution.

• Reduce the declaration to the minimum necessary permission set, such as:

  yaml

  allowed-tools: Read
  

• If a future feature genuinely requires command execution, expose a narrowly scoped tool or fixed operation instead of unrestricted Bash.

• Require explicit user approval for any shell invocation and enforce command, argument, filesystem, and network allowlists at runtime.

• Run necessary commands in an isolated sandbox with minimal filesystem access, no inherited secrets, restricted network access, resource limits, and a non-privileged operating-system identity.

• Document the exact reason for every granted tool and periodically verify that declared permissions remain necessary.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation example "[Generate Finance Ad Creative Brief] for my team" does not clearly constrain when the skill should activate beyond a generic team-oriented request. Because the file does not provide explicit trigger boundaries or negative examples, this phrase could match routine conversation and cause unintended invocation.

Content

No source excerpt is available for this finding.