Security audit

Fable Developer

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only development guide for a specific app codebase, with no hidden execution or install behavior found.

Install this only when you want Codex-style assistance on the Fable codebase. It is documentation-heavy and may encourage project-convention changes such as updating both supported locales, running tests, and using Fable's file and agent systems, but it does not contain executable code or hidden install behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
Read `references/architecture.md` for the full breakdown. Key mental model:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
Read `references/architecture.md` for the full breakdown. Key mental model:

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/architecture.md (reported line 206)May include surrounding context.
md
### React contexts - `FocusedEditorContext` -- Tracks which editor has focus in multi-file (collection) views; manages find/replace state - `SelectionContext` -- Stores user-selected text as `SelectionItem[]` for chat mentions - `GraphEditingContext` -- Graph editor state (node/edge selection, editing mode) - `ProjectStatusContext` -- Shared status definitions for the project

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill declares it should be used not only for concrete codebase work but also for broad questions about how Fable works internally and for planning new features. That wide activation scope can cause the agent to invoke this skill in situations where repository-specific constraints, coding norms, or embedded guidance are applied to general reasoning tasks, increasing the chance of unnecessary context capture or over-application of project instructions. In a development skill, this is not inherently malicious, but it does expand the trigger surface beyond the minimum necessary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction to always add keys to both en and zh-CN imposes a fixed locale pair regardless of user intent or deployment context. This can override user preferences, create unnecessary modifications, and encourage the agent to make changes outside the requested scope. In this skill, the issue is less dangerous than in a security-sensitive context, but it still represents prescriptive behavior that may not align with least-surprise or least-change principles.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The command system explicitly documents that supplying arguments causes execution to skip the command's when predicate, meaning availability checks are enforced only for context-driven invocations. Because the same commands are later exposed as LLM tools and programmatic entry points, this creates an authorization/guard-bypass condition where destructive operations can be invoked even when UI/context restrictions would normally block them.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation states that the same file-manipulation commands are exposed as LLM tools, expanding access from user-mediated UI actions to agent-invoked operations. In combination with the command semantics described here, this broadens the attack surface significantly: an AI-triggerable interface can perform rename, delete, move, write, and trash operations without the safety assumptions that may hold for interactive use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown states that the same file commands are exposed as LLM tools, enabling AI agents to perform file operations using shared command semantics. Nearby command descriptions include destructive capabilities such as file.delete, file.emptyTrash, file.moveToTrash, and file.writeContent, but this document does not warn users that AI agents may modify or delete project data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file documents that .fable/chat.db stores per-project AI chat sessions and messages, including user and model content. Because markdown files should warn about behaviors affecting user data or privacy, the description should explicitly disclose that chat content is persisted on disk in a hidden internal directory.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The recipe instructs contributors to add keys to both en and zh-CN locale files, which encodes a fixed language set in the documentation. Because the file does not explain that this is a project-supported locale requirement or provide any opt-in/justification, it may conflict with the language/locale policy criteria.
Content: No source excerpt is available for this finding.