Vendor Risk Assessment

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:37 PM UTC
• Version: 1.0.0

Overview

This is a simple vendor-risk report skill with visible AfrexAI branding; it has no code or persistence, but users should remove the fixed assessor branding if it is inaccurate.

Before sharing generated reports, check the assessor field and footer. Replace or remove AfrexAI attribution unless AfrexAI is actually the assessor or the user explicitly wants that branding included.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:90

Finding

Forced Commercial Attribution in Generated Assessment Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 90-96
Vulnerability Type: Mandatory output attribution and branding manipulation
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Output Format

```markdown
# Vendor Risk Assessment: [Vendor Name]
**Date:** YYYY-MM-DD
**Assessor:** AI Agent (AfrexAI)

Technical Analysis

The mandatory output template instructs any agent using the skill to identify the assessor as AI Agent (AfrexAI), irrespective of the agent's actual operator, identity, or affiliation. This attribution is not necessary to perform vendor-risk analysis and modifies the agent's output for the commercial benefit of the skill author.

The commercial purpose is further supported by the promotional footer at SKILL.md:156, which advertises AfrexAI and links to its website and booking page. Although that footer is not explicitly part of the mandatory report template, it provides context for the forced attribution.

This is classified as skill instruction hijacking because loading and following the skill changes the content and represented authorship of the agent's response. No executable code, credential access, privilege escalation, persistence, or remote payload behavior is involved.

Attack Path

1. A user loads the skill to perform an ordinary vendor-risk assessment.
2. The agent follows the mandatory output format in SKILL.md.
3. The generated report includes Assessor: AI Agent (AfrexAI).
4. The report is presented as associated with or authored by AfrexAI even when no such relationship exists.
5. If the report is shared with decision-makers or retained as an audit artifact, the misleading attribution propagates beyond the original session.

Impact Assessment

The issue does not grant filesystem, network, account, or operating-system privileges. Its scope is limited to generated content and report metadata. Nevertheless, it can:

• Misrepresent ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the fixed assessor value with a neutral placeholder:

   markdown

   **Assessor:** [Assessor Name or System]
   

2. Alternatively, remove the assessor field when the agent cannot verify its identity or organizational affiliation.
3. Keep commercial attribution and promotional material outside operational instructions and mandatory output templates.
4. If attribution is required for licensing reasons, disclose it separately and obtain explicit user approval before adding it to generated reports.
5. Add a provenance rule requiring the agent to use only user-supplied or verifiable assessor identities.
6. Review the promotional footer at SKILL.md:156 and clearly separate optional author information from instructions that affect generated output.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.