SecretCodex

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:18 PM UTC
• Version: 1.0.0

Overview

The skill is a non-executable cipher guide, but it sometimes presents obsolete ciphers as strong protection for sensitive information.

Install only if you want an educational or puzzle-oriented cipher guide. Do not use this skill's classical ciphers to protect passwords, financial, medical, legal, personal, business-confidential, or other sensitive information; use established encrypted messaging or modern authenticated encryption tools instead.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:657

Finding

Misleading Security Claims Encourage Use of Obsolete Ciphers for Sensitive Communications

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:657-674, SKILL.md:747-756, README.md:137-157
Vulnerability Type: Misleading cryptographic security guidance
Risk Level: Medium

Vulnerable Content

SKILL.md:657-674 presents classical ciphers as a solution for sensitive team information:

markdown

**Scenario:** Remote team needs to share sensitive project info.

**Solution:**

Code Name System:

• Project: "Operation Silver Dawn"
• Team members: Phoenix, Atlas, Cipher, Raven
• Milestones: Alpha, Bravo, Charlie, Delta

Sensitive Message Encoding: Method: Columnar Transposition + Substitution Key: Team keyword "SILVERDOWN" (agreed in kickoff meeting)

Message: "Phoenix reports Charlie milestone complete on schedule"

Encoded: "PXHNIR ETORCP HLEIM TSOEE NLTCP SEODH EUELN"

text

`SKILL.md:747-756` overstates the resistance of obsolete cryptographic methods:

```markdown
- Vigenère: Keyword-based secrecy
- Polybius: Numeric encoding
- Rail Fence: Pattern scrambling

**Strong Security (Days/weeks to crack):**
- Playfair: Digraph substitution
- Columnar Transposition: Keyword ordering
- Double encryption: Layered methods

**Maximum Security (Theoretically unbreakable):**
- One-Time Pad: True randomness + single use

README.md:137-157 directly responds to a maximum-security request by recommending a combination of Vigenère and Rail Fence:

markdown

You: I need maximum security for a message. How do I layer ciphers?

AI: For strong security, use DOUBLE ENCRYPTION:

MESSAGE: "ATTACK AT DAWN"

STEP 1: Vigenère with keyword "FORTRESS"
Result: "FMMPBK PY KPDS"

STEP 2: Rail Fence with 4 rails
Input: FMMPBKPYKPDS
Output: FKYPB MDPMK S

FINAL CIPHERTEXT: "FKYPB MDPMK S"

TO DECODE:
1. Friend reverses Rail Fence (4 rails) → gets "FMMPBKPYKPDS"
2. Friend decrypts Vigenère ("FORTRESS") → gets "ATTACK AT DAWN"

Key sharing: "FORTRESS, then 4 rails" (sh
...[truncated 3117 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict all classical ciphers to clearly labeled educational, puzzle, game, and reversible-obfuscation use cases.
2. Remove claims including “strong security,” “serious encoding,” “days/weeks to crack,” and recommendations to use classical ciphers for sensitive project information.
3. Change the maximum-security example so the agent refuses to protect sensitive information with historical ciphers.
4. Recommend established end-to-end encrypted applications, such as Signal, for sensitive messaging.
5. For software-oriented use cases, recommend reviewed libraries implementing authenticated encryption such as AES-GCM or ChaCha20-Poly1305. Do not encourage users to design or combine encryption schemes themselves.
6. State prominently, before every actionable encoding example, that classical ciphers provide obfuscation rather than modern confidentiality.
7. Clarify that layering weak historical ciphers does not provide authenticated encryption and does not prevent practical cryptanalysis or tampering.
8. Present one-time pads only as a theoretical educational topic unless the workflow can guarantee uniform random key generation, secure key distribution, message-length keys, secure storage, and single use.
9. Add a decision rule instructing the agent to redirect requests involving financial, medical, legal, credential, personal, or business-confidential data to established secure tools.
10. Review all sample ciphertexts for mathematical correctness so educational examples do not create additional false confidence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md

- 🔒 **Encode secret messages** using 10+ cipher methods (Caesar, Vigenère, Playfair, Rail Fence, OTP, and more)
- 🔓 **Decode messages** from friends/family (with the key they share)
- 🎓 **Learn cryptography** through hands-on examples
- 🎮 **Create puzzles** for scavenger hunts and games
- 🔑 **Master key management** (the real secret to security)

## Installation

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file includes a 'When to Use This Skill' section, so SQP-1 applies. The activation guidance is framed as broad intents like 'encode a secret message' and 'learn how different ciphers work' without clearer trigger constraints or exclusions, which could overlap with ordinary user requests and cause unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.