AU Migration Visa File Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 1.0.0

Overview

This instruction-only skill is mostly coherent, but it needs review because it asks for client identifying details in chat while also saying not to collect them.

Before installing, review and revise the letter-drafting prompts so the agent uses placeholders, initials, or a file reference instead of asking for a real client's full name. Treat the skill as static drafting guidance only, and verify all current visa fees, occupation lists, processing times, and legal requirements against official sources before using outputs with clients.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:484

Finding

Unnecessary Solicitation of Client Personally Identifiable Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 484; conflicting privacy control at line 655
Vulnerability Type: Unnecessary collection of personally identifiable information
Risk Level: Medium

Complete Vulnerable Snippet

markdown

- Client's full name and country of origin

The instruction conflicts with the following privacy control later in the same file:

markdown

10. **Protect client privacy at all times.** Do not encourage the user to share the client's full name, date of birth, or passport number in the chat. Use initials or a file reference code when discussing specific client situations.

Technical Analysis

The client-letter workflow explicitly instructs the agent to request a client's full name, although the skill separately recognizes that full names should not be shared in chat. The conflicting instructions create an insecure data-minimization practice: depending on which instruction the agent follows, it may solicit real client identity data unnecessarily.

A full name is not required to generate a draft because a placeholder, initials, or a non-identifying file reference can be used. Country of origin or nationality should only be requested when materially relevant to a visa requirement and should not be collected automatically for every letter.

The project contains no executable code, external API integration, or storage mechanism. Therefore, this finding does not establish that the skill itself exfiltrates or persistently stores the information. The risk arises when sensitive client information enters the AI service's chat-processing, logging, telemetry, or retention boundary.

Attack Path

1. A user asks the agent to draft a client letter.
2. The agent follows the context-gathering instruction at line 484.
3. The agent requests the client's full name and country of origin.
4. The user provides real client identity information.
5. The information is submitted to the AI service and may become subj ...[truncated 933 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the vulnerable instruction with a privacy-preserving version:

markdown

- Client initials, a non-identifying file reference, or placeholders for the draft
- Nationality only when materially relevant to the requested task

2. Apply the privacy rule consistently to all context-gathering workflows, templates, and examples.

3. Add an explicit data-minimization instruction before the letter-drafting questions:

markdown

Do not request or accept a client's full name, date of birth, passport number, residential address, or other direct identifiers. Use placeholders, initials, or a file reference in every draft.

4. If a user supplies identifying information without being asked, instruct the agent not to reproduce it unnecessarily and to substitute placeholders in the generated letter.

5. Request nationality or country information only when it changes a documented requirement, such as biometrics or police-clearance guidance. Avoid requesting it for generic drafting tasks.

6. Review the entire skill for other conflicts between task-specific collection instructions and the privacy guardrail, and make the privacy rule controlling in every workflow.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to ask for the client's full name and country of origin when drafting letters, but a later guardrail explicitly says not to encourage sharing full name, date of birth, or passport number in chat. This inconsistency can cause unnecessary collection of personally identifiable information in conversation logs, increasing privacy and confidentiality risk for migration clients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Requesting the client's full name and country of origin in chat conflicts with the later instruction to protect client privacy and avoid sharing full identifying details. In a migration practice context, nationality and identity details are sensitive legal-matter data, so this contradiction creates a real risk of over-collection and exposure in chat transcripts or downstream logging systems.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example workflow explicitly asks for a client named Maria when the skill elsewhere says not to encourage sharing full identifying details in chat. Because examples are highly influential for model behavior, this can override the privacy safeguard in practice and lead agents to solicit real client names in a sensitive legal-services context.

Content

No source excerpt is available for this finding.