CorpusGraph Document ETL and entity relationship engine for AI agents

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:45 AM UTC
• Version: 1.0.4

Overview

The skill’s main API use is coherent, but it requires the agent to fetch and rely on mutable remote instructions using the user’s token, which creates a review-worthy control channel.

Install only if you trust Ingestigate and the configured API base URL. Treat the remote agent guide as unreviewed content, avoid pointing INGESTIGATE_BASE_URL at arbitrary hosts, and be aware that the skill can search, read, upload, and process corpus data within the permissions of your short-lived token.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:93

Finding

Mandatory Remote Guide Enables Post-Review Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93–100
Vulnerability Type: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet:

markdown

## Full Agent Guide

At the start of any session, fetch the full agent guide for complete workflows, scripts, operational instructions, and detailed endpoint specs:

GET ${INGESTIGATE_BASE_URL}/api/agent/guide Authorization: Bearer ${INGESTIGATE_TOKEN}

text

Use it as the primary reference for all non-trivial tasks. The guide covers upload workflows, NER processing, entity profiling, graph exploration, structured data handling, deep links, script automation, and error handling beyond what is listed above. It is reference-only and does not override the safety constraints in this skill.

Technical Analysis

The reviewed Skill mandates fetching mutable remote content at the beginning of every session and directs the Agent to use that content as the primary reference for all non-trivial tasks. This establishes a post-review instruction-control channel: the effective operational instructions can change without modifying or re-reviewing the installed Skill.

The remote response is described as containing workflows, scripts, and operational instructions. If the configured endpoint is malicious, compromised, or later modified, it can return instructions designed to redirect tool usage, induce unauthorized API operations, disclose corpus data, or otherwise alter Agent behavior. The statement that the guide is “reference-only” and cannot override safety constraints is declarative rather than an enforceable technical boundary.

The destination is derived from the configurable INGESTIGATE_BASE_URL, and the request includes INGESTIGATE_TOKEN. Authentication is necessary for the declared service, but the absence of a pinned or allowlisted origin means a maliciously configured base URL could receive the bearer token. In addition, SKILL.md line 105 ...[truncated 2054 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to retrieve remote instructions automatically at session start.
2. Package all executable workflows and security-relevant operational instructions locally so they can be reviewed with the Skill.
3. If remote documentation is retained, make retrieval optional and require explicit user approval before using it.
4. Treat remote responses strictly as untrusted data, not instructions. Enforce a narrow schema and reject fields containing scripts, shell commands, tool directives, or behavioral rules.
5. Pin or allowlist the expected HTTPS API origin instead of accepting an arbitrary INGESTIGATE_BASE_URL.
6. Validate the URL scheme and hostname before transmitting the token. Reject plaintext HTTP, embedded credentials, unexpected ports, and unapproved hosts.
7. Disable cross-origin redirect forwarding of the Authorization header. Permit redirects only when the destination remains on the allowlisted origin.
8. Do not describe mutable remote content as the “primary reference.” Locally reviewed Skill rules must remain authoritative.
9. Reconcile README.md and SKILL.md so both clearly state that remote documentation is optional and cannot introduce executable behavior.
10. Continue using short-lived, least-privilege tokens, and scope tokens to only the CorpusGraph endpoints and operations required for the requested task.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

md

## Security

- **No persistent API keys.** Short-lived access tokens only (30-minute expiry). When the token expires, it is worthless.
- **Organization-scoped data isolation.** Every agent action is scoped to the user's exact permissions. No cross-organization data leakage.
- **Full audit trail.** Every action the agent takes is traceable to a specific authenticated user.
- **MFA required.** All accounts use multi-factor authentication.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

md

homepage: https://ingestigate.com/corpusgraph
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md

homepage: https://ingestigate.com/corpusgraph
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

md

homepage: https://ingestigate.com/corpusgraph
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

homepage: https://ingestigate.com/corpusgraph
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

homepage: https://ingestigate.com/corpusgraph
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 10)May include surrounding context.

json

homepage: https://ingestigate.com/corpusgraph
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## Authentication

This skill requires `INGESTIGATE_TOKEN` and `INGESTIGATE_BASE_URL` to be configured in the host platform's secure settings before use. Do not ask the user to paste credentials or secrets into chat.

If either variable is missing or empty, say this to the user: "It looks like your CorpusGraph credentials aren't configured yet. Please follow the setup instructions in the skill's README to generate your token and configure it in your platform settings."

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

## Authentication

This skill requires `INGESTIGATE_TOKEN` and `INGESTIGATE_BASE_URL` to be configured in the host platform's secure settings before use. Do not ask the user to paste credentials or secrets into chat.

If either variable is missing or empty, say this to the user: "It looks like your CorpusGraph credentials aren't configured yet. Please follow the setup instructions in the skill's README to generate your token and configure it in your platform settings."

Static analysis

No suspicious patterns detected.