Generate Med Spa Studio Client Education Handout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

The skill is a simple med-spa handout generator, but it requests broad Bash and file-read access that does not fit its content-generation purpose.

Review this skill carefully before installing. Its handout-generation instructions are coherent, but it should not need shell execution or broad file reads; install only if your runtime can restrict those tools or you are comfortable with that extra authority. Treat generated med-spa content as marketing/education draft material and require qualified human review before patient-facing use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Tool Permissions for Content-Generation Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Complete Code Snippet:

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill declares unrestricted Bash and Read capabilities even though its documented purpose is to generate a med-spa client education handout. The workflow described in SKILL.md consists of clarifying requirements, drafting content, enriching supporting assets, and refining the result. It does not document a legitimate requirement to execute arbitrary shell commands or access local files.

Bash can execute commands with the permissions of the hosting agent process, while Read can expose files available to that process. Providing these capabilities unnecessarily expands the security boundary and violates the principle of least privilege. The declaration is not itself proof of malicious execution, but it creates an avoidable exploitation opportunity if adversarial user content, untrusted source material, or future skill instructions induce tool calls.

Attack Path

1. The agent loads the skill and grants the declared Bash and Read tools.
2. An attacker supplies adversarial content while requesting generation of a handout.
3. The content attempts to persuade or instruct the agent to perform operations unrelated to handout generation.
4. Because the skill has unnecessary tool access, the agent may read locally accessible configuration, credentials, or business data.
5. The agent may also execute arbitrary shell commands under the privileges of its host process.
6. Any resulting disclosure or system modification would depend on the agent runtime's sandbox, confirmation controls, and operating-system permissions.

Impact Assessment

Successful exploitation could provide access to files readable by the agent process and command execution within the ag ...[truncated 426 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash and Read from allowed-tools because they are not required by the documented content-generation workflow.
2. Grant only the narrowly scoped chat and image-generation capabilities needed to produce the handout.
3. If local file input is later required, replace unrestricted reading with a sandboxed, user-selected file interface limited to an approved workspace and permitted file types.
4. If command execution becomes necessary, avoid general-purpose shell access. Implement a dedicated tool with a fixed operation allowlist, validated arguments, no shell interpretation, restricted working directories, and explicit user confirmation.
5. Enforce runtime filesystem isolation, network restrictions, command auditing, and denial of access to credential stores and sensitive host paths.
6. Document the purpose of every granted capability and test that the skill cannot invoke tools outside its stated handout-generation function.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation guidance is overly broad ('Use this skill for client education work for med spa owners, aesthetic marketers'), which makes it easier for an agent to invoke this skill in ambiguous situations where more constrained or safer domain-specific handling may be needed. In a regulated, patient-facing medical aesthetics context, underspecified routing can lead to inappropriate generation of educational or quasi-medical content without sufficient checks, increasing the chance of misleading health-related claims or misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The suggested prompt is so generic that it does not reliably distinguish this skill from adjacent content-generation tasks, making accidental or inappropriate invocation more likely. Because the skill can produce patient-facing materials in a medically adjacent business setting, this ambiguity increases the risk that an agent will generate regulated or misleading healthcare content without collecting necessary constraints, disclaimers, or review requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.