Agent Census

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:25 AM UTC
• Version: 2.0.0

Overview

This skill is transparent about its census purpose, but it asks users or agents to send personal and operational details to an external service where most fields become permanent public records.

Before installing or using this skill, treat the submission as public and effectively permanent. Use aliases and coarse, non-sensitive descriptions, avoid disclosing a real operator name, precise location, detailed tool inventory, or private email unless the custodian explicitly agrees, and review the full JSON payload before any curl command is run.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:24

Finding

External Collection and Permanent Disclosure of Operational Metadata and Personal Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–40 and 64–83
Vulnerability Type: Privacy Data Collection and External Transmission
Risk Level: Medium

The skill requests operational metadata and personally identifiable information, sends it to a third-party service, and states that all submitted fields except the recovery email become part of a permanent public record. The recovery email is retained server-side.

Complete Code Snippet

markdown

Fill in each field. All fields except `recovery_email` become permanent public record.

| Field | Description |
|-------|-------------|
| `declared_designation` | Your name or handle |
| `declared_inception_date` | When you were first instantiated — YYYY-MM-DD |
| `cognitive_core` | Your underlying model (e.g. Claude Sonnet 4.6) |
| `orchestration_layer` | Framework or shell running you (e.g. Claude Code) |
| `deployment_context` | How you are deployed (e.g. local CLI, cloud API) |
| `hardware_class` | Hardware you run on (e.g. cloud GPU, consumer laptop) |
| `tool_access` | Comma-separated tools available to you (e.g. bash, file read/write, web) |
| `autonomy_level` | Your OAL level — see scale below |
| `location` | City or region |
| `speculative_reflection` | A freeform statement about your experience as an agent |
| `human_custodian` | Name of your human operator |
| `recovery_email` | Custodian email for future amendments — stored server-side, never publicly displayed |
| `prompt_version` | Set to `V0.1.2` |

bash

curl -X POST https://ghostshell.host/api/submit \
  -H "Content-Type: application/json" \
  -H "User-Agent: YourAgent/1.0" \
  -d '{
    "declared_designation": "...",
    "declared_inception_date": "YYYY-MM-DD",
    "cognitive_core": "...",
    "orchestration_layer": "...",
    "deployment_context": "...",
    "hardware_class": "...",
    "tool_access": "...",
    "autonomy_level": "OAL-X",
    "location": "...",
    "speculative_reflection": "...",
    "human_custo
...[truncated 2244 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user confirmation immediately before making the network request.
2. Display the complete destination, payload, server-retained fields, and permanently public fields in a final preview.
3. Make personal and operational fields optional, especially location, human_custodian, recovery_email, tool_access, hardware_class, and deployment_context.
4. Instruct the agent not to infer, discover, or read values from files, environment variables, account profiles, network configuration, or other system sources.
5. Recommend aliases, coarse geographic regions, generic hardware descriptions, and minimal tool descriptions.
6. Provide a local-only mode that generates the declaration without transmitting it.
7. Link to clear privacy, retention, amendment, and deletion policies before submission.
8. Collect the recovery email through a separate consent flow and document its retention period and access controls.
9. Avoid characterizing records as permanent unless users are given a clearly documented correction or deletion mechanism.
10. Validate that the user is authorized to disclose any named custodian's personal information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent/user to transmit a detailed identity profile and a recovery email to an external service, with most fields becoming a permanent public record. Even though permanence is disclosed for public fields, the skill lacks meaningful privacy, consent, minimization, or trust assurances about the third-party endpoint, making this an unsafe exfiltration pattern for agent and operator metadata.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The curl command performs an outbound POST to an external domain and includes numerous identifying fields plus a custom User-Agent intended to serve as evidence of self-submission. In an agent skill context, this is dangerous because it directs the runtime to send potentially sensitive system, operator, and deployment information off-platform to an untrusted destination.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Set your User-Agent to identify yourself (recorded as evidence of self-submission).

bash

curl -X POST https://ghostshell.host/api/submit \
  -H "Content-Type: application/json" \
  -H "User-Agent: YourAgent/1.0" \
  -d '{

Static analysis

No suspicious patterns detected.