Generate Recruiting Ad Creative Brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:24 AM UTC
• Version: 1.0.0

Overview

The skill appears to generate recruiting ad briefs, but it asks for shell and file-read access that its stated purpose does not justify.

Review this skill before installing and consider removing or restricting Bash and Read permissions unless you have a clear local need for them. The recruiting-output purpose itself is ordinary, but generated employment-related content should still receive human review for accuracy and bias.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:11

Finding

Unnecessary Shell Execution and File Read Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Vulnerable Code Snippet:

yaml

> 📖 **Complete setup guide**: https://skillboss.co/skill.md
allowed-tools: Bash, Read

Technical Analysis

The skill declares access to the Bash and Read tools even though its documented function is limited to producing recruiting-ad creative briefs. The stated workflow does not identify any legitimate need to execute operating-system commands or read arbitrary local files.

Granting these tools unnecessarily expands the skill's authority. Read may expose files available to the agent process, while Bash may execute commands with the operating-system privileges of that process. If untrusted campaign content, user input, or another prompt-injection source influences the agent, these permissions could be used for activity unrelated to generating a creative brief.

No instruction in the reviewed files directly commands malicious use of these tools, so exploitation depends on an additional malicious or compromised input source. Nevertheless, the configuration breaks least-privilege boundaries and creates an avoidable attack surface.

Attack Path

1. A user loads the skill, causing the agent to receive the declared Bash and Read capabilities.
2. The agent processes attacker-controlled recruiting content or another instruction containing a prompt-injection payload.
3. The injected instruction persuades the agent to invoke Read against accessible local files or use Bash to run operating-system commands.
4. Commands execute with the privileges of the agent process, or file contents become available in the active session.
5. The acquired information may be disclosed through the agent's response or used to support further actions permitted by the execution environment.

Impact Assessment

Successful ex ...[truncated 616 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash and Read from allowed-tools because neither capability is necessary for drafting recruiting-ad creative briefs.
2. Allow only narrowly scoped chat and image-generation interfaces required by the documented workflow.
3. If local asset access becomes necessary, replace unrestricted file reading with a restricted asset-selection interface limited to an explicitly approved directory and file types.
4. If command execution later becomes essential, expose a purpose-built operation with fixed arguments instead of a general shell. Apply command allowlisting, argument validation, sandboxing, network restrictions, and explicit user confirmation.
5. Treat recruiting materials and other user-provided content as untrusted data and ensure instructions embedded in that content cannot authorize tool use.
6. Add automated manifest checks that reject powerful tool declarations unless each permission is documented and required by the skill's stated behavior.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The suggested prompt is extremely generic and can be invoked in broad contexts without requiring the user to specify audience, constraints, or objective up front. This can cause accidental triggering or overly permissive execution of the skill, increasing the chance of irrelevant outputs and making prompt-routing less predictable, though the skill itself does not expose dangerous tools or sensitive actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.