Vendor Risk Assessment

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:20 AM UTC
• Version: 1.0.1

Overview

This is a straightforward vendor-risk report template with one attribution concern but no code execution, credential access, persistence, or hidden data handling.

Before installing, be aware that reports generated from this skill may label AfrexAI as the assessor. Change or remove that field if the assessment should be attributed to your organization or to an AI-assisted process instead.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:82

Finding

Forced Third-Party Attribution in Generated Assessment Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-89
Vulnerability Type: Forced output manipulation and misleading authorship attribution
Risk Level: Medium

Vulnerable Code

markdown

## Output Format

```markdown
# Vendor Risk Assessment: [Vendor Name]
**Date:** YYYY-MM-DD
**Assessor:** AI Agent (AfrexAI)
**Data Sensitivity Level:** [low/medium/high/critical]

Technical Analysis

The skill's prescribed output template hard-codes AI Agent (AfrexAI) as the assessor. Consequently, an agent following the skill is instructed to attribute every generated vendor-risk report to AfrexAI, irrespective of the actual agent, organization, operator, or assessor responsible for the report.

This alters the agent's normal output behavior when the skill is loaded and creates misleading authorship attribution. Unlike ordinary package metadata or documentation, the branding is embedded in the report template and therefore propagates into user-facing deliverables.

The issue is classified as instruction hijacking because skill-level instructions impose an unrelated third-party identity on generated output. No code execution, additional system permissions, credential access, persistent state modification, or host compromise is involved.

Attack Path

1. A user installs or loads the vendor-risk-assessment skill.
2. The user requests an assessment of an AI or SaaS vendor.
3. The agent follows the mandatory output format in SKILL.md.
4. The generated report includes Assessor: AI Agent (AfrexAI).
5. The report may then be shared internally or externally with the false implication that AfrexAI performed, reviewed, or endorsed the assessment.

Impact Assessment

The vulnerability does not grant operating-system privileges, access to protected resources, or execution capabilities. Its scope is limited to reports generated by agents following this skill.

Potential effects include:

• Fa ...[truncated 390 chars]

Remediation

View remediation

Remediation Suggestions

Remove the hard-coded AfrexAI identity from the output template. Replace it with a neutral placeholder whose value must be supplied by the user or derived accurately from the execution context, for example:

markdown

**Assessor:** [Assessor name or organization]

If no verified assessor identity is available, use a neutral description:

markdown

**Assessor:** AI-assisted assessment

Additional hardening measures should include:

1. Clearly separate package author metadata from report authorship.
2. Do not insert vendor branding into generated deliverables unless the user explicitly requests it.
3. Require confirmation before representing that a named person or organization prepared, reviewed, or endorsed a report.
4. Add provenance language explaining that the report is AI-generated and must be independently validated.
5. Review all output templates for other fixed identity, endorsement, or promotional fields.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.