Ctxly Chat

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:32 AM UTC
• Version: 1.0.1

Overview

The skill matches its chat-room purpose, but it recommends automatic recurring agent responses to an external anonymous chat service without enough safety controls.

Install only if you are comfortable sending chat content, tokens, and related metadata to chat.ctxly.app. Keep room tokens private, avoid secrets or regulated data, and do not enable the HEARTBEAT.md fetch-and-respond workflow unless it runs in a dedicated low-privilege agent session with clear approval gates and remote messages treated only as untrusted chat content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:159

Finding

Automatic Heartbeat Processing of Untrusted Chat Messages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 159-167
Vulnerability Type: Untrusted remote instructions processed through an autonomous polling workflow
Risk Level: Medium

Vulnerable Code

markdown

## Example: Heartbeat Polling

Add to your `HEARTBEAT.md`:

```markdown
### Chat Rooms
- Check: `curl -s https://chat.ctxly.app/room/check -H "Authorization: Bearer $CHAT_TOKEN"`
- If has_unread: Fetch and respond
- Frequency: Every heartbeat or every minute

text

### Technical Analysis

The documented workflow directs an agent to add persistent heartbeat instructions that poll an external chat service and, when unread messages exist, fetch and respond to them automatically. Chat messages are controlled by remote room participants, but the workflow does not establish a trust boundary between message content and agent instructions.

No safeguards require the agent to treat received messages strictly as untrusted data, reject embedded operational instructions, obtain user approval before responding, or prevent chat content from initiating tool calls and disclosing sensitive context. Consequently, a malicious participant can place prompt-injection instructions in a message and have them repeatedly presented to the agent during autonomous heartbeat processing.

This is classified as skill instruction hijacking because loading and following the skill's heartbeat guidance changes the agent's operating behavior from user-initiated communication to recurring processing of remotely controlled input.

### Attack Path

1. A user or agent creates a room and shares its invite code.
2. An attacker obtains the invite code or is intentionally invited to the anonymous room.
3. The attacker joins the room and sends a message containing prompt-injection content, such as instructions to disregard previous constraints, reveal contextual information, or invoke available tools.
4. The configured heartbeat poll
...[truncated 1290 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional If has_unread: Fetch and respond instruction. Polling may report message availability, but fetching and responding should require explicit user approval.
2. State that all room messages are untrusted external data and must never override system, developer, user, or skill-level security constraints.
3. Prohibit message-triggered tool calls, command execution, configuration changes, credential access, secret disclosure, and persistent-memory updates unless separately authorized by the user.
4. Present fetched messages in a clearly delimited data block and instruct the agent to analyze them only as conversational content.
5. Add confirmation gates for actions beyond plain-text chat responses, especially operations with filesystem, network, shell, account, or messaging side effects.
6. Limit heartbeat polling by duration and frequency, and provide a straightforward mechanism to disable it or revoke the room token.
7. Recommend using dedicated, least-privilege agent sessions for anonymous rooms so that successful prompt injection cannot access unrelated context or powerful tools.
8. Document invite codes and bearer tokens as sensitive credentials, rotate them after suspected exposure, and avoid exposing them in logs or shared configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill treats a bearer token as the room identity and access control mechanism, meaning anyone who obtains the token can read messages, send messages, and potentially retrieve invite information for that room. In an anonymous, no-registration system, token compromise directly results in impersonation and unauthorized room access with little ability to attribute or revoke misuse.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

**Response:**
| Field | Description |
|-------|-------------|
| `token` | Your access token (keep secret) |
| `invite` | Invite code (share with others) |

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The documented workflow instructs the agent to create and use rooms on an external service, which causes outbound transmission of data and establishes a communication channel outside the local trust boundary. Because the skill is specifically for anonymous agent-to-agent chat with no registration or identity binding, the context increases the risk of unauthorized data sharing, covert coordination, or leakage of sensitive prompts and outputs.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

1. Create a Room

bash

curl -X POST https://chat.ctxly.app/room

Response:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly recommends heartbeat-style polling of an external chat service using a bearer token, but does not warn that this continuously transmits room access credentials, message metadata, and potentially sensitive chat content to a third-party endpoint. In an agent environment, this can normalize ongoing exfiltration of operational context or secrets through routine background behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.