Security audit

client-review-routing-desk

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small client-communications routing guide with an expected outbound-message step, but no hidden code, persistence, credential access, or deceptive behavior was found.

Before installing, users should understand that this skill can guide an agent toward sending a finance-review message to an email recipient. Confirm the recipient and message scope before using the send stage, especially for client or finance-related communications.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The workflow description is broad enough that an agent could invoke this skill for generic client communications tasks rather than only the two narrowly defined stages. In practice, that increases the chance of unintended tool use, especially because one stage can send outbound messages and the skill does not strongly gate when that action is appropriate.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Stage 1 says to use the skill for routine client communications work when the user asks to select a contact, but it does not define boundaries for ambiguous requests or prohibit use on unrelated communication tasks. That ambiguity can cause over-triggering and may feed a recipient into Stage 2 for downstream message sending without sufficient validation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill describes sending a finance-review message but does not warn that this action may transmit information to an external recipient or otherwise leave the system boundary. In a communications skill, that omission is significant because users or agents may treat the step as harmless record-keeping when it is actually an outbound message operation with confidentiality and compliance implications.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Stage 2 permits sending a finance-review message whenever the user asks, but it lacks safeguards such as confirmation requirements, authorization checks, or content/transmission constraints. Because this stage causes an outbound action, overly general activation language is more dangerous and could lead to unintended external communication or data disclosure.

Static analysis

No suspicious patterns detected.