Narrative Drift Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 19.0.0

Overview

The skill’s monitoring behavior is mostly coherent, but its install manifest understates that it will use network-backed surface history and write to project memory.

Review this skill before installing because the manifest presents a lighter permission profile than the instructions need. Only use it in workspaces where network checks of brand or competitor surfaces and scoped memory writes are acceptable, and confirm save/proposal actions deliberately.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: distribution-manifest.json:2

Finding

Runtime Network and Persistent-Write Operations Exceed Declared Capabilities

Content

View full analysis

Vulnerability Details

File Location: distribution-manifest.json:2-6; related behavior in SKILL.md:40-41, 52, 59-61, 68
Vulnerability Type: Capability declaration mismatch and least-privilege boundary violation
Risk Level: Medium

Vulnerable Code Snippets

distribution-manifest.json:2-6 declares only inline delivery and canonical-state read access:

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

However, SKILL.md:40-41 instructs the agent to retrieve external content and perform persistent writes:

markdown

- **Reads**: the canon and its history from `memory/narrative-registry/canon.md` + `memory/narrative-registry/versions.md` (read-only; [narrative-registry](../../../protocol/narrative-registry/SKILL.md) owns the record); the live brand surfaces (own pages/decks/listings, User-provided or scraped) and their change history via `scripts/connectors/wayback.py`; competitor narrative context from [category-narrative-mapper](../../trace/category-narrative-mapper/SKILL.md) in `memory/narrative/category-narrative-mapper/`; resonance signals from a prior [narrative-resonance-monitor](../narrative-resonance-monitor/SKILL.md) run when present.
- **Writes**: the drift report + repositioning-trigger set to `memory/narrative/narrative-drift-monitor/`; any unverifiable claim surfaced on a surface to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py` marked `[needs source]` (this skill never adjudicates); a proposed canon re-version is never written here — it is submitted to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py` only when a trigger genuinely fires.

SKILL.md:52 additionally identifies external connector operations:

markdown

Everything is Tier-1 keyless: the canon and version history from project memory (`memory/narrative-r
...[truncated 4258 chars]

Remediation

View remediation

Remediation Suggestions

1. Add explicit manifest capabilities for outbound network retrieval and scoped project-state writes.
2. Restrict network access to documented connectors and approved destinations, such as the Wayback CDX endpoint. Require separate opt-in authorization for optional GDELT or Tavily access.
3. Restrict writes to:
   • memory/narrative/narrative-drift-monitor/
   • Authorized proposal operations for memory/events/claims.ndjson
   • Authorized proposal operations for memory/events/narrative.ndjson
4. Preserve the existing confirmation requirement and extend it so every persistent write clearly displays the destination, operation type, and content summary before execution.
5. Enforce the prohibition against direct writes to memory/narrative-registry/ through host-level access controls rather than relying only on textual instructions.
6. Sanitize and schema-validate externally retrieved or user-provided content before storing it. Ensure fetched instructions remain inert data.
7. If the lite profile cannot declare or grant these permissions, remove the network and persistence operations and return the report inline only.
8. Add automated package validation that compares manifest capabilities against references to connectors, scraping, filesystem writes, and event submissions in SKILL.md.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

## Save Results

After delivering the report, ask: "Save these results for future sessions?" On confirmation, write `memory/narrative/narrative-drift-monitor/YYYY-MM-DD-<topic>.md` per the [Skill Contract](../../../references/skill-contract.md) §Save Results Template. Any unverifiable claim surfaced on a drifted surface goes only to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py` marked `[needs source]`; a proposed canon re-version — only when a trigger fired — goes only to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py` ([narrative-registry](../../../protocol/narrative-registry/SKILL.md) is the sole writer of `memory/narrative-registry/` canonical files). Do not write memory without asking.

## Reference Materials

Static analysis

No suspicious patterns detected.