Brand Language Codifier

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 19.0.0

Overview

This skill has a coherent brand-language purpose, but it asks to write persistent project memory despite a manifest that advertises only inline output and read access.

Review this before installing if your host enforces capability approvals. The skill appears purpose-aligned and not malicious, but it should either declare its persistent write scope or return proposed registry records inline for a separately authorized writer.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: distribution-manifest.json:2

Finding

Persistent state writes exceed the capabilities declared by the package manifest

Content

View full analysis

Vulnerability Details

File Location: distribution-manifest.json:2-6; related instructions in SKILL.md:39-40, 52, 68, 72
Vulnerability Type: Capability-boundary violation
Risk Level: Medium

Vulnerable Code

The package manifest declares only inline delivery and canonical-state read access:

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

However, the skill contract instructs the agent to perform persistent writes:

markdown

- **Writes**: the voice + naming draft to `memory/narrative/brand-language-codifier/`; complete canon-grade voice rules and naming taxonomy as an authorized `operation: propose` request through `registry-events.py` to `memory/events/narrative.ndjson` for narrative-registry to resolve; any product or comparative claim used as fact as a separate claims proposal tagged `[needs source]` — this skill never performs canonical mutations or adjudicates claims.
- **Promotes**: the approved banned-phrase list and the naming tax as pending-decision items via `memory/open-loops.md` and a one-line summary to `memory/hot-cache.md` (ask before writing); never writes `decisions.md` directly.

Additional instructions direct writes to event registries:

markdown

5. **Sweep the claims** — if a sample's voice example carries a product or comparative claim ("the fastest…", "trusted by X"), do not encode it as on-brand fact: mark it `[needs source]` and submit it to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`.

markdown

7. **Stage for canon** — write canon-grade voice rules and the naming tax to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py`.

markdown

After delivering the canon, ask: "Save these results for future sessions?" On confirmation, save to `memory/narrative/brand-language-codifier/YY
...[truncated 2706 chars]

Remediation

View remediation

Remediation Suggestions

1. Update distribution-manifest.json to declare every required persistent-state write capability, including the permitted path scope and whether writes occur directly or through registry-events.py.
2. If the lite profile does not allow persistent writes, remove the write and staging instructions and return proposed records inline for an explicitly authorized component to persist.
3. Require a distinct, informed confirmation immediately before every persistent operation. The prompt should list the exact destination path, operation type, and data being written.
4. Separate inline generation from persistence so successful skill completion does not depend on undeclared writes.
5. Restrict writes to an allowlist of exact paths and reject path traversal, symlinks, unexpected registry destinations, and direct canonical-state mutation.
6. Validate and sanitize all user-provided or scraped material before including it in persistent proposals. Preserve provenance labels and prevent source text from being interpreted as executable agent instructions.
7. Add automated package validation that compares file-write instructions and tool usage against the capabilities declared in the distribution manifest.
8. Ensure the host denies operations outside declared capabilities rather than relying exclusively on natural-language instructions or user confirmation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

## Save Results

After delivering the canon, ask: "Save these results for future sessions?" On confirmation, save to `memory/narrative/brand-language-codifier/YYYY-MM-DD-<brand>.md` — see [skill-contract.md](../../../references/skill-contract.md) §Save Results Template. Canon-grade voice rules and the naming tax go **only** to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py` ([narrative-registry](../../../protocol/narrative-registry/SKILL.md) is the sole writer of `memory/narrative-registry/`); any `[needs source]` claim wording goes **only** to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`. Do not write memory without asking.

## Reference Materials

Static analysis

No suspicious patterns detected.