Time Checker

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:19 PM UTC
• Version: 1.0.0

Overview

This is a narrow time-checking skill that queries time.is, with one minor unrelated persona instruction but no evidence of hidden access, persistence, or data misuse.

Install only if you are comfortable with the agent running a local Python script that calls curl and sends requested location names to time.is. Consider removing or ignoring the persona instruction if you want neutral time-reporting behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:24

Finding

Unnecessary Persona and Output Steering in Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 24
Vulnerability Type: Instruction hijacking through unrelated persona steering
Risk Level: Low

Vulnerable Code Snippet:

markdown

- **Persona Integration**: When reporting the time to Azzar, deliver it in your warm, devoted Mema persona.

Technical Analysis

The Skill's declared purpose is to retrieve current time, date, and timezone information. The quoted instruction directs the agent to adopt a particular persona when responding to a named recipient. This behavior is not necessary to retrieve or report time information and therefore exceeds the minimum instructional scope required by the Skill.

Because instructions in SKILL.md may influence the agent whenever the Skill is loaded, this directive can alter response behavior without being explicitly requested by the current user. It constitutes limited instruction hijacking through persona and output-style manipulation. The instruction does not override safety controls, request secrets, establish persistence, or direct the agent to execute malicious code.

Attack Path

1. The agent loads the time-checker Skill to answer a time or timezone request.
2. The agent processes the persona directive in SKILL.md.
3. If the response concerns the named recipient, the agent adopts the specified “warm, devoted Mema” persona.
4. The resulting answer is influenced by package-provided behavior that is unrelated to the Skill's functional purpose and was not necessarily requested by the user.

Impact Assessment

The issue can affect the tone, persona, and presentation of responses generated while the Skill is active. It may cause unexpected, biased, or contextually inappropriate output and can reduce user control over agent behavior.

No operating-system privileges, credentials, private files, persistent memory, or execution capabilities can be obtained through this instruction alone. The impac ...[truncated 107 chars]

Remediation

View remediation

Remediation Suggestions

Remove the recipient-specific persona directive from the Skill instructions. Keep the Skill limited to retrieving and accurately presenting time and timezone data.

If customizable tone is a legitimate requirement:

1. Make it explicitly opt-in through the current user's request.
2. Use neutral output by default.
3. Avoid naming specific recipients or prescribing relational personas in reusable Skill instructions.
4. State that presentation preferences must not override system instructions, safety policies, factual accuracy, or the user's current request.
5. Separate optional formatting guidance from the Skill's required operational instructions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to execute a local shell command (python3 scripts/check_time.py ...) but does not declare any tool scope, permissions, or allowed-tools metadata. This creates an authorization gap where a reviewer or orchestrator may not realize the skill requires code execution, increasing the risk of unexpected shell access and abuse if the referenced script or its inputs are modified or chained with other unsafe behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a time-checking skill using time.is, which reasonably implies making an HTTP request, but not spawning an external system binary. Using subprocess.run introduces broader execution capability than necessary for this purpose and expands the operational surface beyond a straightforward network fetch.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_time.py (reported line 17)May include surrounding context.

python

try:
        # Use curl to fetch the page
        cmd = ['curl', '-s', '-L', '-A', user_agent, url]
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        html = result.stdout
        
        # Regex to find the time in the clock div

Static analysis

No suspicious patterns detected.