Security audit

Algernon Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed study-system orchestrator that reads its own OpenAlgernon study state and routes study commands, with some broad routing language but no hidden, destructive, or credential-seeking behavior.

Install this only if you want an agent to automatically load OpenAlgernon study memory and recent study logs when a study session starts or when you ask about materials. Use explicit commands when possible, because ambiguous study-related phrasing may be interpreted and routed to another OpenAlgernon skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill description says it routes any unmatched command to the right sub-skill, creating a catch-all dispatcher with unclear boundaries. This is dangerous because ambiguous or adversarial prompts may be misclassified and trigger unintended capabilities, especially when the orchestrator performs privileged context loading and delegates into other skills.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation trigger is broad enough to fire on generic requests about available materials, which can cause this orchestrator to take over conversations outside an explicit study-session start. In an agentic environment, overly permissive activation increases the chance of unintended file reads, database queries, and routing behavior being invoked from ambiguous user input.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: Natural-language routing based on inferred study intent is underspecified and lacks explicit constraints, making the dispatcher vulnerable to misrouting on ambiguous text. In a multi-skill system, this can be exploited through prompt phrasing to steer execution into unintended flows or cause the assistant to act without sufficiently clear user authorization.

Static analysis

No suspicious patterns detected.