Message System Architect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 19.0.0

Overview

The skill is mostly coherent for building a brand message system, but its instructions include persistent project-memory writes that are not declared in its lite/read-oriented manifest.

Review this skill before installing in a lite or read-only environment. It should either declare narrowly scoped write/proposal capabilities for the listed memory paths or operate in an inline-only mode that returns proposed records for a separately authorized registry to persist.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:41

Finding

Persistent State Writes Exceed the Declared Capability Ceiling

Content

View full analysis

Vulnerability Details

File Location: distribution-manifest.json:2-6; SKILL.md:41-43,65-66,70
Vulnerability Type: Capability declaration mismatch and unauthorized persistent-state modification
Risk Level: Medium

Vulnerable Code

distribution-manifest.json:2-6

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

SKILL.md:41-43

markdown

- **Writes**: the durable message house to `memory/narrative/message-system-architect/`; the canon-grade block (main narrative, pillars + claim IDs, tagline) to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py` only — [narrative-registry](../../../protocol/narrative-registry/SKILL.md) is the sole writer of `memory/narrative-registry/canon.md`; every unsubstantiated claim to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py` tagged `[needs source]`, never `memory/claims/claims-ledger.md` directly.
- **Promotes**: the approved main narrative, tagline, and pillar set as pending-decision items via `memory/open-loops.md` (ask before writing); durable message choices are proposed as pending decisions — never written to `decisions.md` directly.
- **Done when**: the house names a main narrative, three value pillars each traceable to a named positioning value theme (no orphan pillar), a tagline/one-liner, and per-persona proof points each labeled Measured / User-provided / `[needs source]`; the internal-consistency pass finds no tagline↔pillar↔proof contradiction; and every `[needs source]` claim is in `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py` with the canon-grade block queued to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py`.

SKILL.md:65-66

markdown

8. **Sweep the claims** — list every product or comparative claim used anywh
...[truncated 4382 chars]

Remediation

View remediation

Remediation Suggestions

1. Align the manifest with actual behavior. If persistent proposal writes are intentional, declare narrowly scoped capabilities for writing the specified message-house directory and event streams. Do not use a broad filesystem-write permission where path-specific authorization is available.

2. Enforce capabilities at runtime. The host or registry-events.py must verify that the calling skill has explicit permission to perform the requested operation. Authorization must not rely solely on the skill including the word “authorized” in its instructions.

3. Require explicit confirmation for every persistent write. Present the exact destination, operation, and proposed content before writing to:

   • memory/events/claims.ndjson
   • memory/events/narrative.ndjson
   • memory/open-loops.md
   • memory/narrative/message-system-architect/

4. Provide a read-only fallback. Under the current lite profile, return the proposed event records and message house inline without writing them. A separately authorized registry component can persist them later.

5. Validate event records. Apply schema validation, destination allowlisting, length limits, provenance fields, and escaping before accepting claim or narrative proposals derived from untrusted source material.

6. Preserve separation of duties. Continue preventing this skill from writing directly to memory/claims/claims-ledger.md or memory/narrative-registry/canon.md. Promotion should remain the responsibility of independently authorized registry components.

7. Add capability-consistency tests. Package validation should fail when skill instructions advertise persistent writes that are absent from the manifest's declared capabilities.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

## Save Results

After delivering the house, ask: "Save these results for future sessions?" On confirmation, save to `memory/narrative/message-system-architect/YYYY-MM-DD-<brand>.md` — see [skill-contract.md](../../../references/skill-contract.md) §Save Results Template. The canon-grade block goes only to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py` ([narrative-registry](../../../protocol/narrative-registry/SKILL.md) is the sole writer of the canon of record); claim wording goes only to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`. Do not write memory without asking.

## Reference Materials

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The display name, summary, and description include Chinese text alongside English, but the file does not state that the skill is intended specifically for bilingual or Chinese-language contexts, nor does it offer the user a language preference. This can create a language/locale policy issue because the skill appears to impose multilingual output or branding context without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.