Back to skill

Security audit

Elixir Docs Review

Security checks for vulnerabilities and agentic risk

Overview

This is a plain Markdown guidance skill for reviewing Elixir documentation, with no executable code, persistence, credential handling, or hidden data movement.

Installers should treat this as low-risk documentation-review guidance. Be aware that following its optional verification flow may involve reading project source and running tests, and the separate review-verification-protocol dependency should be trusted before use.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/spec-coverage.md (reported line 226)May include surrounding context.

def permissions(:admin), do: [:read, :write, :delete] def permissions(:editor), do: [:read, :write] def permissions(:viewer), do: [:read]

Dialyzer warns if a new role is added to the type but not handled here

text

Tips for Dialyzer compatibility:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The @doc text first says the function 'returns whether the request should proceed,' which implies a boolean result, but a few lines later says it returns {:ok, remaining} or {:error, :rate_limited}. Because this file is guidance for reviewing documentation quality, embedding a contradictory example directly conflicts with the stated instructional intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.