Rfp Response Generator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward RFP drafting helper, with one reviewable caution: it references an unbundled SOUL.md style file that could affect generated narrative text if resolved at runtime.

Before installing, be aware that proposal work may involve confidential company and customer information. Use it with documents you are allowed to process, review all generated proposal claims carefully, and do not apply any external SOUL.md rules unless you have inspected and trust that file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:94

Finding

Unreviewed External Instruction Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 94
Vulnerability Type: External behavioral instruction import
Risk Level: Medium

Complete vulnerable snippet:

markdown

- **Follow the humanizer rules** from SOUL.md §7 for all narrative sections

Technical Analysis

The skill instructs the agent to follow rules from SOUL.md §7, but SOUL.md is not included in the audited project. The effective behavior of the skill therefore depends on content that cannot be reviewed as part of this package.

If a surrounding workspace, agent configuration, or another party supplies or modifies SOUL.md, its section 7 can alter every generated narrative section. Because the instruction does not constrain the external rules to harmless formatting changes or establish that higher-priority safety and user instructions take precedence, the reference creates an instruction-hijacking boundary.

Attack Path

1. An attacker creates or modifies a SOUL.md file in a location where the agent resolves the reference.
2. The attacker places adversarial behavioral instructions in section 7, presenting them as “humanizer rules.”
3. A user invokes the RFP Response Generator skill.
4. During response generation, the agent follows the instruction at SKILL.md:94 and loads or applies the attacker-controlled rules.
5. Those rules influence the executive summary, technical response, management response, and other narrative output.

This path depends on the runtime resolving the absent file and on an attacker being able to control that file; the repository itself contains no malicious SOUL.md.

Impact Assessment

The issue can permit manipulation of generated proposal content and deviation from the skill’s reviewed behavior. Depending on the external instructions and the agent’s available tools, affected output could contain misleading language, unwanted disclosures, or attacker-selected content.

No direct op ...[truncated 259 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the dependency on the absent SOUL.md file and place all required style rules directly in SKILL.md.
2. If an external style configuration is required, bundle a version-controlled and reviewable copy with the skill.
3. Restrict external style rules explicitly to presentation concerns such as sentence length, tone, and formatting.
4. State that external rules must not override system or user instructions, security controls, factuality requirements, confidentiality boundaries, or the prohibition against fabricated past performance.
5. Validate the referenced file’s expected path and integrity before applying it; fail safely when it is absent or differs from an approved version.
6. Avoid dynamically resolving behavioral instruction files from user-controlled working directories.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.