Security audit

Minimalist Entrepreneur

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only business advice skill pack with no code execution, credential access, persistence, or hidden system changes.

Installers should expect opinionated startup and small-business advice that may activate on broad entrepreneurship prompts. Treat its pricing, hiring, remote-work, and growth recommendations as guidance to review against your own constraints, not as automatic operational decisions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises automatic activation from broad natural-language prompts like 'Help me find a business idea' or 'What should I charge for this?', which are ordinary conversational phrases likely to appear in unrelated contexts. Overly broad triggers can cause the wrong skill to activate unexpectedly, leading to prompt-scope confusion and untrusted instruction injection into benign conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description is broad enough to trigger on many generic business or hiring-related prompts, which can cause unintended invocation and override a more appropriate skill or baseline assistant behavior. While not directly malicious, overbroad routing increases the chance of irrelevant or opinionated guidance being injected into user workflows without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation guidance says to use the skill when someone is 'looking for a business idea,' 'trying to find their community,' or 'wondering where to start as an entrepreneur.' These are high-level, common phrases without clear boundaries or exclusion conditions, which could cause the skill to trigger for many general business-advice conversations rather than a narrow, well-defined use case.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description says to use the skill when someone 'has a product and needs to find customers, or is struggling with early sales,' which is a wide and ambiguous condition rather than a narrowly defined trigger. It does not provide explicit trigger phrases, boundaries, or negative examples to clarify when this skill should be selected versus other generic sales or marketing advice skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says to use the skill when someone wants a gut-check on a business decision, wants to simplify their approach, or needs to decide between options. These activation conditions are broad and likely to overlap with many ordinary requests, without clear constraints or exclusion conditions for when this skill should not be invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description says to use the skill when someone is 'ready to build their first product or struggling with scope,' which is a wide and subjective trigger without clear boundaries. It does not provide specific invocation phrases, exclusions, or narrow context, increasing the chance of unintended activation in general entrepreneurship discussions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill states 'and you probably should be' regarding remote work, which prescriptively biases recommendations without considering the user's industry, constraints, or preferences. This can steer users toward operational decisions that may be unsuitable for regulated, physical, or highly collaborative environments, reducing trust and quality of advice.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Line L03 says to use the skill when someone is 'setting prices, considering price changes, or struggling with what to charge,' which is fairly open-ended and lacks explicit trigger phrases or negative examples. In a manifest-style description, this can cause the skill to activate for a wide range of ordinary business discussions rather than a narrowly defined pricing task.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.