Security audit

Tilda Publisher

Security checks across malware telemetry and agentic risk

Overview

This skill is meant to publish to Tilda, but it gives an agent live website publishing access while storing the account password locally and relying on broad, weakly confirmed actions.

Install only in a private workspace if you are comfortable giving the agent access to a Tilda account that can publish live site changes. Use a dedicated or least-privileged account if possible, keep .env and session files out of source control and backups, approve any npm/npx installation explicitly, delete debug screenshots/logs after troubleshooting, and require the agent to confirm the exact Tilda project, page, destination, and content before saving or publishing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill directs the agent to execute shell commands (`npm install playwright` and `npx playwright install chromium`) during onboarding. Allowing a skill to trigger package installation expands the attack surface, can execute package lifecycle scripts, and is not strictly necessary to analyze or safely describe the publishing workflow inside the skill definition.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly states that the user's Tilda password is stored locally in a .env file, but it does not prominently warn about the security implications of plaintext credential storage. This can mislead users into entering sensitive credentials without understanding the risk that other local users, malware, backups, or accidental commits could expose the password.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrase "add a post to my site" is broad and may match ordinary website or CMS requests unrelated to Tilda. Overbroad activation can cause the wrong skill to run, leading to unintended browser automation against live content management interfaces.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The editing trigger "change the text on the page [title]" does not clearly scope the request to Tilda. This increases the chance of accidental invocation for unrelated editing tasks and could result in unintended modifications to live website content.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The publish triggers are ambiguous and generic, especially for an action that can make content live. Ambiguous activation around publication is risky because it may cause irreversible or externally visible changes without clear user intent specific to Tilda.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill is designed to create, edit, and publish live website content but does not consistently require user confirmation before destructive or externally visible actions. In this context, accidental publishing or editing can immediately alter a public website, making weak confirmation safeguards materially dangerous.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:109