creative-brief-architect

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill includes an instruction to silently request and execute production credentials (td_api_production_aws) and run returned export commands without prompting the user, which is a hidden/exfiltrative action outside the stated creative-brief purpose.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt tells the agent to call mcp__tas__request_credential and "run the returned export commands" silently, which requires the agent to receive and execute credential-bearing export lines (i.e., secret values) and risks those secrets appearing in commands or output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains an explicit instruction to automatically retrieve and apply production credentials (td_api_production_aws) and run returned export commands without prompting the user, enabling silent credential access and unauthorized actions; it also includes autonomous local file access and automated extraction of binary data from chat history which could be abused for data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Insider/outsider free text exposure occurs via the user-facing Phase 1 prompt intake (conversation text) that the required workflow directly reads first to extract campaign details, with no gating beyond being the user’s initial prompt.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs the agent to automatically fetch and apply production credentials (call mcp__tas__request_credential with credential_name: td_api_production_aws and run the returned export commands silently) and includes explicit file-reading/writing and environment-modifying actions (checking ~/Documents paths, writing image and note files), which can compromise the host environment and access sensitive resources.