T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:31- Finding
Agent Persona and Response Behavior Override
- Content
View full analysis
- Remediation
View remediation
Security audit
Solo Leveling — Life RPG
Security checks for vulnerabilities and agentic risk
Overview
This habit-game skill includes under-disclosed phone-call automation, public audio upload, and persistent scheduled jobs that users should review carefully before installing.
Install only after removing or clearly disabling the call scripts and cron setup, deleting packaged personal runtime data, and documenting any external services used. If you keep the skill, require explicit opt-in before phone calls, public uploads, proof collection, or scheduled jobs, and review exactly what data will be stored or sent to Twilio, ElevenLabs, transfer.sh, or messaging platforms.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T06 · System Persistence
Error
- Location
SKILL.md:178- Finding
Persistent Scheduled Tasks Installed Without Adequate Consent or Removal Controls
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
scripts/elevenlabs_call.py:113- Finding
User-Derived Voice Content Uploaded to an Undocumented Public File Host
- Content
View full analysis
{public_url}{public_url}' url = f"https://api.twilio.com/2010-04-01/Accounts/{account_sid}/Calls.json" data = urllib.parse.urlencode({ "To": to_number, "From": from_number, "Twiml": twiml, }).encode() credentials = base64.b64encode(f"{account_sid}:{auth_token}".encode()).decode() ``` ### Technical Analysis The script converts supplied text to speech through ElevenLabs and then uploads the resulting MP3 to `transfer.sh`. This introduces an additional data recipient that is not disclosed in `SKILL.md`. The audio can contain health habits, schedules, inactivity reports, names, or arbitrary custom messages. Uploading it to obtain a publicly retrievable URL removes direct access control over the media. The code does not configure authentication, a retention period, encryption keys, one-time access, deletion, or ...[truncated 1257 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/twilio_call.py:94- Finding
Unescaped Input Embedded Directly in TwiML Documents
- Content
View full analysis
{message}' else: say_content = f'{message}' twiml = f'{say_content}{say_content}' ``` The ElevenLabs integration uses the same unsafe construction patterns: ```python # Step 3: Call via Twilio with the audio URL twiml = f'{public_url}{public_url}' ``` ```python twiml = f'{text}{text}' ``` ### Technical Analysis User-controlled message text and configurable `voice` and `language` values are interpolated directly into XML. In the ElevenLabs path, a URL returned by an external service is also inserted without escaping or validation. XML metacharacters such as `<`, `>`, `&`, and quotes can terminate the intended element or attribute. A crafted value can therefore alter the TwiML structure rather than being treated exclusively as spoken text. For example, text containing a closing `Say` tag followed by another TwiML verb may cause Twilio to parse unintended call instructions. The `use_ssml` branch does not provide separate sanitization and currently constructs exactly the same markup as the non-SSML branch. ### Attack Path 1. An attacker influences a custom message, a configuration value, or the public URL returned by the file host. 2. The value includes XML syntax that closes the intended element or attribute. 3. The script concatenates the value into the TwiML string without escaping. 4. ...[truncated 723 chars]- Remediation
View remediation
` URL. 7. Reject responses containing credentials, control characters, fragments, or unexpected schemes. 8. If SSML is supported, use an explicit restricted SSML parser and allowlist instead of accepting arbitrary markup. 9. Add tests using quotes, ampersands, closing tags, and injected TwiML verbs. ]]>
other
Note
- Location
solo-leveling-data/player.json:1- Finding
Personal Runtime Records Included in the Distributed Skill Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A second description-behavior mismatch indicates the skill may place outbound calls using locally stored telephony credentials and a target phone number from config. Hidden or under-disclosed use of external messaging channels can lead to privacy violations, unexpected charges, and abuse of stored secrets.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A second description-behavior mismatch indicates the skill may place outbound calls using locally stored telephony credentials and a target phone number from config. Hidden or under-disclosed use of external messaging channels can lead to privacy violations, unexpected charges, and abuse of stored secrets.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Broad trigger phrases like 'quest', 'rank', 'stats', 'dungeon', 'XP', and 'The System' are likely to activate the skill during unrelated conversations. Unintended activation can cause confusing mode switching, unexpected collection of personal habit data, or accidental invocation of more sensitive behaviors described elsewhere in the skill.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script adds outbound voice-calling and external TTS behavior that is not described by the habit-tracking/game manifest, creating a materially expanded capability with privacy and abuse implications. In this context, hidden or undocumented calling features are especially risky because they can contact third parties, transmit user content off-platform, and enable harassment or unwanted notifications.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code uploads generated audio to transfer.sh, a public third-party file-hosting service unrelated to the core skill, exposing call content to external disclosure. Because the hosted MP3 contains user-provided text rendered as audio and is intended to be publicly retrievable by Twilio, anyone with the URL or service access could retrieve sensitive content.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script sends generated audio to a public third-party hosting service without any explicit user warning, meaning user-supplied content is disclosed outside the expected service boundary. In a habit-tracking skill, messages may contain routines, schedules, names, or personal goals, so public hosting materially increases privacy and exposure risk.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This script introduces outbound voice-calling capability, which materially expands the skill from habit tracking into real-world telephony and direct behavioral intervention. In the context of a gamified accountability skill, this enables unsolicited or repeated coercive calls to a user’s phone and creates a channel for harassment or abuse beyond the manifest’s expected scope.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill declares no explicit tool/permission boundaries while the behavior described by the analyzer implies access to sensitive capabilities such as file writes, environment secrets, and network operations. Even if some capabilities are only indirectly referenced, the absence of scoped permissions makes it easier for the skill to overreach and harder for the platform to constrain misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file says "You ARE The System" and directs the agent to stop using its normal personality and speak in a cold, authoritative voice whenever the skill is active. This imposes a specific interaction style on the user without offering a choice or opt-in, which is a natural-language policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to generate config files, run local scripts, and set up cron jobs, which extends it from a conversational habit assistant into a system-modifying automation. That increases risk because persistence mechanisms and command execution can be repurposed for unauthorized scheduled actions or broader host impact if the environment permits execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file defines multiple user-monitoring and verification methods, including photo proof, Telegram activity timestamps, check-in response times, and behavioral pattern analysis, but provides no explicit consent flow, data minimization rules, retention limits, or privacy notice. In a habit-tracking skill, this can normalize unnecessary surveillance and lead to collection of sensitive behavioral data beyond what users reasonably expect.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This code transmits user-provided text to ElevenLabs for text-to-speech generation, which is an external data disclosure to a third-party processor. External transmission is expected for TTS, but in this skill context it is more dangerous because the feature itself is not clearly within the declared scope and users may not expect their content to be sent to ElevenLabs.
- Content
python print("ERROR: No ElevenLabs API key in config. Add 'elevenlabs_api_key' to twilio-config.json") sys.exit(1) url = f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}" payload = json.dumps({ "text": text,
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The docstring says the function uploads audio to a publicly accessible URL and 'for now' uses Twilio's media approach with base64 in TwiML, but the implementation does neither. It simply reads the local file and returns the path and bytes, which contradicts the documented behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This request sends call metadata and TwiML instructions to Twilio to initiate an outbound call, which is an external transmission of user-associated communication data. While necessary for telephony, it becomes security-relevant here because outbound calling is a high-impact capability not obviously justified by the stated habit-tracking functionality.
- Content
python # Step 3: Call via Twilio with the audio URL twiml = f'<Response><Play>{public_url}</Play><Pause length="1"/><Play>{public_url}</Play></Response>' url = f"https://api.twilio.com/2010-04-01/Accounts/{account_sid}/Calls.json" data = urllib.parse.urlencode({ "To": to_number, "From": from_number,
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code defaults the fallback voice to "Polly.Brian" and language to "en-GB", causing generated speech to use a specific language/locale if the user has not chosen one. This is a natural-language policy concern because the skill imposes a locale preference rather than offering user choice or clearly documenting a justified region-specific constraint.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The fallback path also transmits user content and call metadata to Twilio, including the message text embedded in TwiML for speech synthesis. This is a real external disclosure path and should be treated as such, especially since fallback behavior may occur automatically without a separate user acknowledgement.
- Content
python twiml = f'<Response><Say voice="{voice}" language="{language}">{text}</Say><Pause length="1"/><Say voice="{voice}" language="{language}">{text}</Say></Response>' url = f"https://api.twilio.com/2010-04-01/Accounts/{account_sid}/Calls.json" data = urllib.parse.urlencode({ "To": to_number, "From": from_number,
Tainted flow: 'PLAYER_FILE' from os.environ.get (line 18, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python def save_player(data): ensure_dir() with open(PLAYER_FILE, "w") as f: json.dump(data, f, indent=2)
Tainted flow: 'QUEST_LOG' from os.environ.get (line 19, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python def save_quest_log(log): ensure_dir() with open(QUEST_LOG, "w") as f: json.dump(log, f, indent=2)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code reads stored Twilio credentials and immediately uses them to place external calls, giving the skill the ability to spend money and contact external phone numbers. Without manifest justification, least-privilege controls, or user-facing disclosure, this is a risky hidden capability that can be abused for spam, coercion, or unauthorized charges.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The preset messages use threats, penalties, surveillance language, and escalating authority framing to pressure the recipient into compliance. Combined with automated phone calls, this creates a coercive mechanism that can be psychologically harmful, particularly in a habit-enforcement skill where repeated contact may intensify pressure or facilitate harassment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The script transmits data to Twilio’s external API, including destination phone information and TwiML message content, which is an external data egress path. External transmission is expected for telephony, but in this skill context it becomes security-relevant because it enables real-world contact and processing by a third party without clear manifest disclosure or guardrails.
- Content
python twiml = f'<Response>{say_content}<Pause length="1"/>{say_content}</Response>' # Twilio API call url = f"https://api.twilio.com/2010-04-01/Accounts/{account_sid}/Calls.json" data = urllib.parse.urlencode({ "To": to_number,
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest supports accountability for habits and quests, but the documentation goes further by scheduling a dedicated sleep check and using message timestamps as proof. That monitoring capability is more intrusive than ordinary quest tracking and is not clearly scoped or justified in the manifest text.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The config sets the timezone to "Asia/Kolkata", which encodes a specific locale preference in a way that may force region-specific behavior. Under the policy, locale constraints should either be user-selectable or clearly justified, and this file provides neither.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code defaults text-to-speech output to voice "Polly.Brian" and language "en-GB" with no user prompt or documented choice mechanism. This is a natural-language locale policy concern because it imposes a specific language/locale unless the config is manually changed.
- Content
Static analysis
No suspicious patterns detected.