Early Access Designer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 19.0.0

Overview

The skill is a coherent early-access planning helper, but its install manifest understates the persistent memory and registry writes its instructions require.

Install only if you are comfortable with this skill proposing or saving launch-stage information into persistent agent memory. The publisher should update the manifest to declare the write and registry-proposal capabilities, and users should review each destination and payload before approving persistence.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: distribution-manifest.json:2

Finding

Persistent State Writes Exceed the Capabilities Declared by the Package Manifest

Content

View full analysis

Vulnerability Details

File Location: distribution-manifest.json:2-6; SKILL.md:42-43, 67, 71
Vulnerability Type: Capability declaration mismatch and insecure configuration
Risk Level: Medium

The package manifest declares only inline delivery and canonical-state read capabilities:

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

However, the Skill contract directs the Agent to perform several persistent writes:

markdown

- **Writes**: a user-facing program design + a reusable summary to `memory/launch/early-access-designer/`; stage definitions (names, entry/exit criteria, target dates, the GA opt-out-inclusion decision) are submitted to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` for [launch-registry](../../../protocol/launch-registry/SKILL.md) to formalize — this skill never writes `memory/launch-registry/` directly.
- **Promotes**: the chosen stage ladder, graduation thresholds, and invite-throttle decision to `memory/hot-cache.md` and `memory/open-loops.md` (ask before writing); durable program choices as pending-decision items — never writes `decisions.md` directly.

It also makes submission to persistent event storage part of the normal workflow:

markdown

8. **Submit the stage definitions to the registry** — stage names, entry/exit criteria, target dates, and the GA opt-out-inclusion decision go to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` for [launch-registry](../../../protocol/launch-registry/SKILL.md) to formalize as the canonical record the `RAMP-R1` stage-truth check reads. This skill never writes the canonical record.

Technical Analysis

The manifest presents the package as requiring only inline output and canonical-state reading, while the Skill instructions define write operations against m ...[truncated 3400 chars]

Remediation

View remediation

Remediation Suggestions

1. Update distribution-manifest.json to declare every required state-mutation capability, including event proposal and persistent memory-write operations.
2. Raise the capability profile or ceiling if the lite profile does not permit the required write operations.
3. Make the manifest the enforceable source of truth: the host should reject any tool call or filesystem mutation not covered by the package’s declared capabilities.
4. Separate design generation from persistence. By default, return a structured proposal inline and require a separately authorized component to commit it.
5. Require explicit, operation-specific user confirmation before every persistent mutation, including registry proposal submission—not only summary, hot-cache, and open-loop writes.
6. Display the exact destination, operation, and data fields before requesting approval.
7. Restrict writes to allowlisted paths and prevent path substitution or traversal.
8. Validate and sanitize all user-provided or exported values before placing them into NDJSON or Markdown state files.
9. Record an audit log containing the approving user, destination, operation, timestamp, and content digest.
10. Add automated package validation that compares paths and mutating operations referenced by SKILL.md against the capabilities declared in the distribution manifest, and fail packaging when they do not match.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

## Save Results

After delivering the program design, ask: "Save these results for future sessions?" On confirmation, save to `memory/launch/early-access-designer/YYYY-MM-DD-<product-or-stage>.md` — see [Skill Contract](../../../references/skill-contract.md) §Save Results Template. Stage facts (names, entry/exit criteria, dates, the GA opt-out-inclusion decision) go to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` only. Do not write memory without asking.

## Reference Materials

Static analysis

No suspicious patterns detected.