Back to skill

Security audit

ilang-compress

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only prompt-compression skill with clear warnings that its action-like notation should be reviewed before use in execution tools.

Before installing, understand that this skill produces compact command-like text. It does not execute actions itself, but you should review any output containing destructive or broad terms such as DEL, WRIT, SYNC, @LOCAL, @DRIVE, or @R2 before giving it to another agent or automation system that might act on it.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This manifest-like JSON uses a natural-language input phrase as the apparent trigger, but "Translate this document to Chinese and save it to cloud storage" is broad enough to overlap with ordinary user requests. The file provides no explicit trigger scope, exclusions, or negative examples to clarify when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language input and transformation output both hard-code translation to Chinese ("lng=zh") with no indication that the user can choose another language or opt in to this locale constraint. This can violate language/locale policy expectations when a skill imposes a specific language without documented justification.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
80% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
Data I/O: READ, WRIT, DEL, LIST, COPY, MOVE, STRM, CACH, SYNC, Π
Transform: Σ, Δ, φ, ∇, DEDU, ∂, CHNK, FLAT, NEST, λ, REDU, PIVT, TRNS, ENCD, DECD, ξ, ζ, EXPN, θ, FMT
Analysis: ψ, CLST, SCOR, BNCH, AUDT, VALD, CNT, μ, TRND, CORR, FRCS, ANOM
Generation: CREA, DRFT, PARA, EXPD, SHRT, STYL, TMPL, FILL
Output: Ω, DISP, EXPT, PRNT, LOG
Meta: HELP, DESC, INTR, NOOP

Unbounded Output

Medium
Category
Output Handling
Confidence
80% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · prompt.md (reported line 18)May include surrounding context.

md
Data I/O: READ, WRIT, DEL, LIST, COPY, MOVE, STRM, CACH, SYNC, Π
Transform: Σ, Δ, φ, ∇, DEDU, ∂, CHNK, FLAT, NEST, λ, REDU, PIVT, TRNS, ENCD, DECD, ξ, ζ, EXPN, θ, FMT
Analysis: ψ, CLST, SCOR, BNCH, AUDT, VALD, CNT, μ, TRND, CORR, FRCS, ANOM
Generation: CREA, DRFT, PARA, EXPD, SHRT, STYL, TMPL, FILL
Output: Ω, DISP, EXPT, PRNT, LOG
Meta: HELP, DESC, INTR, NOOP

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This manifest describes the skill generically as compressing natural language prompts into I-Lang, but it does not provide any explicit trigger phrases, scope constraints, or exclusion conditions. For a manifest file, that ambiguity can make it unclear when the skill should be invoked versus ordinary prompt-editing or summarization tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.