T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:554- Finding
Agent Behavior and Output Format Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Senior Python Developer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a Python-development guide, but it overreaches by claiming override authority, forcing chain-of-thought output, and broadening edits beyond the user's likely request.
Install only if you are comfortable with an opinionated Python style guide that may push broad formatting and documentation changes. Treat its response-format and chain-of-thought requirements as unsafe; users should prefer a version that keeps edits scoped to the request, avoids mandatory private reasoning disclosure, and pins container images by digest or reviewed version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:424- Finding
Mutable Latest Tag Used for a Build-Time Dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md adduser --system --uid 1001 --ingroup appgroup appuser # Copy passwd/group to distroless: COPY --from=builder /etc/passwd /etc/passwd COPY --from=builder /etc/group /etc/group USER appuser ```
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md build/ .venv/ venv/ .env *.sqlite3 .ruff_cache/ .pytest_cache/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md build/ .venv/ venv/ .env *.sqlite3 .ruff_cache/ .pytest_cache/
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata hard-codes that reasoning must be output in Russian, removing user choice over language and potentially forcing disclosure of internal deliberative content in a fixed format. This is risky because it normalizes exposing reasoning structure and can conflict with safety policies or user expectations in multilingual environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The response format explicitly mandates a 'Цепочка мыслей' section in Russian, which is effectively an instruction to reveal step-by-step internal reasoning. Requiring chain-of-thought disclosure is dangerous because it can expose sensitive internal decision processes and weaken downstream safety controls.
- Content
Static analysis
No suspicious patterns detected.