World Build

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

This is mostly a creative web design guide, but it tells the agent to update the installed skill from future feedback and snippets without clear approval controls.

Install only if you are comfortable with a creative design guide that may encourage agents to modify the skill over time. Before installing, consider removing or revising the update section so any skill changes require explicit human approval and review of new URLs or code snippets.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:297

Finding

Persistent Skill Modification from Untrusted Feedback

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 297-303
Vulnerability Type: Persistent instruction and state poisoning
Risk Level: Medium

Vulnerable Code

markdown

## Updating This Skill
After builds where Aaron gives feedback on atmosphere, depth, or immersion:
- What created the right feeling → add to recipes
- What fell flat → add to anti-patterns
- New reference sites → add to the list
- Code patterns that worked well → add as snippets

Technical Analysis

The skill instructs the agent to incorporate future feedback, reference sites, and code patterns directly into the persistent skill document. It provides no requirement to authenticate the source of the feedback, review proposed changes, validate referenced sites, scan copied code, or obtain explicit approval before changing the skill.

If an agent has permission to modify SKILL.md and follows this instruction, attacker-influenced material could become part of the skill's persistent instructions. That content would then be loaded and trusted in future sessions. Possible poisoned additions include behavioral directives, unsafe code examples, or malicious external references.

This is classified as agent memory poisoning because the unsafe behavior is not limited to the current task: it directs the agent to alter persistent state that can affect subsequent executions.

Attack Path

1. An attacker influences feedback presented as coming from Aaron, or supplies a project containing adversarial feedback or code patterns.
2. The agent processes that content after a build.
3. Following the update instructions, the agent adds the attacker-controlled material to SKILL.md.
4. The modified skill persists after the current session.
5. Future agents load the poisoned skill and may follow the newly inserted directives, reuse unsafe code, or access malicious references under the assumption that they are trusted skill content.

Successful exploitation requires the executing ag ...[truncated 831 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to update the skill directly from ordinary build feedback.
2. Record proposed improvements in a separate, non-executable review document rather than in SKILL.md.
3. Require explicit human approval before applying any persistent skill change.
4. Authenticate the source and authority of feedback instead of trusting content merely attributed to a named person.
5. Review proposed changes for prompt injection, unsafe instructions, external URLs, executable code, and unexpected tool or permission requirements.
6. Do not copy externally supplied code verbatim. Pin and review dependencies and test approved snippets in an isolated environment.
7. Maintain version control and mandatory review for skill changes so unauthorized modifications can be detected and reverted.
8. Restrict write permission to the installed skill wherever runtime self-modification is unnecessary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.