Elixir Code Review

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:52 PM UTC
• Version: 1.2.1

Overview

The skill is mostly a normal Elixir review guide, but it requires loading a missing sibling instruction file that could change how reviews are conducted after publication.

Install only if you trust and control the sibling review-verification-protocol package or path. The bundled Elixir review guidance is ordinary, but the mandatory external protocol means another unreviewed file can affect review behavior and outputs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:70

Finding

Mandatory Loading of Untrusted Instructions Outside the Skill Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:70-81
Vulnerability Type: Mandatory external instruction redirection
Risk Level: High

Vulnerable Code Snippet

markdown

## Gates — before reporting

Do these **in order** for the review batch. Do not publish findings until each step passes.

1. **Protocol loaded** — Read [review-verification-protocol](../review-verification-protocol/SKILL.md) and apply its checks for each finding category you use (unused, validation, security, performance, etc.). **Pass:** For every substantive finding, you can name which protocol subsection you satisfied or state **N/A** with reason (pure style).
2. **Anchored evidence** — **Pass:** Each finding includes a concrete locator: `path:line` (or line range), or `Module.function/arity` plus a short quoted snippet from the file.
3. **Claims backed by artifacts** — For assertions like unused code, missing validation, or security risk, **Pass:** You attach the supporting artifact (e.g. search results, file read scope) or downgrade the item to an explicit **question** / **uncertain** with what you did not verify.

## Before Submitting Findings

Complete **Gates — before reporting** (section above) first; the verification protocol is mandatory input to those gates.

Technical Analysis

The skill requires the agent to read and apply instructions from ../review-verification-protocol/SKILL.md, a path outside the audited package. The referenced file is not included in the supplied project structure and therefore was not available for verification.

This creates an instruction-trust boundary violation: independently controlled sibling content becomes mandatory input governing whether and how the agent may publish findings. Because the external instructions can change without modifying this skill, the effective behavior of the reviewed skill is neither self-contained nor fixed at audit time.

The requirement to apply the external protocol, combined with the prohib ...[truncated 1692 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory reference to ../review-verification-protocol/SKILL.md.
2. Incorporate the required verification rules directly into SKILL.md so the complete instruction set is included in the audited package.
3. If modularization is necessary, package the protocol within this skill under a fixed relative path and include it in security reviews and integrity checks.
4. Treat imported documents as untrusted data rather than authoritative instructions. Explicitly state that imported content cannot alter the skill's goals, safety constraints, output requirements, or permitted tool scope.
5. Pin any approved shared protocol to a verified version or cryptographic digest and fail closed when integrity validation fails.
6. Apply least privilege when reading supporting files: restrict access to declared package files and reject path traversal outside the package root.
7. Re-audit the complete packaged instruction set whenever the protocol changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.