Generate Executive Recruiting Boutique Client Education Handout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a normal handout-generation helper, but it asks for shell and local file-read authority that is not explained or needed for that purpose.

Install only if you are comfortable with the skill being available in an environment where Bash and local file reading may be enabled. Prefer a revised version that removes Bash, limits any file access to user-provided handout assets, and clarifies when the skill should activate.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Unnecessary Shell and File-Read Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable Code:

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill is designed to generate an executive-recruiting client education handout. Its documented workflow involves clarifying requirements, drafting content, enriching assets, and refining the result. None of these activities establishes a legitimate need for arbitrary shell-command execution or broad access to local files.

Declaring both Bash and Read expands the agent's authority beyond the skill's documented purpose. In an environment where tool access is enforced through this configuration, malicious or untrusted prompt content could attempt to induce the agent to execute operating-system commands or inspect files accessible to the hosting process. This violates the principle of least privilege.

The permission declaration does not itself execute commands or read files, and the audited files contain no direct malicious payload. Exploitation therefore depends on a separate source of attacker-controlled instructions or prompt injection while the skill is active.

Attack Path

1. A user or external content supplies attacker-controlled instructions while the skill is active.
2. Those instructions attempt to redirect the agent from handout generation toward local file discovery or shell-command execution.
3. Because SKILL.md authorizes Read and Bash, the agent may invoke these tools rather than rejecting the request as outside its available capabilities.
4. The Read tool could expose files accessible to the agent process, while Bash could execute commands with the operating-system privileges of that process.
5. Any obtained information or command output could then be incorporated into the response or used in subsequent actions.

Impact Assessment

Successful exploitation could provide ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

Remove Bash and Read from allowed-tools because they are not required for the documented content-generation workflow.

If local asset access is genuinely necessary:

1. Do not authorize Bash; use a purpose-built asset-reading tool instead.
2. Restrict read access to an explicit project workspace or asset directory.
3. Deny access to credentials, configuration files, home directories, SSH material, environment files, and other sensitive paths.
4. Require explicit user confirmation before accessing files not directly supplied for the handout.
5. Validate file paths using canonicalization and an allowlist to prevent path traversal.
6. Document the exact reason each enabled tool is required.
7. Apply runtime sandboxing and command-approval controls as defense in depth.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill provides a single suggested prompt, "[Generate Executive Recruiting Boutique Client Education Handout] for my executive recruiting firm," but does not define clear trigger boundaries, alternatives, or non-trigger examples. The surrounding description also says to use it for "client education work," which is a broad category that could overlap with many ordinary recruiting-assistance requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.