Investigative Pitch Evaluator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 0.1.2

Overview

This is a coherent editorial-assistance skill with one minor conditional feedback link, but no code execution, persistence, data exfiltration, or hidden authority.

Before installing, users should know the skill may process sensitive reporting material, so they should avoid sharing source identities or protected documents unless appropriate for their environment. The final pitch packet should remain a draft reviewed by a human editor or lawyer, as the skill itself says.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:305

Finding

Conditional Injection of Unrelated Promotional Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 305–310
Vulnerability Type: Conditional output manipulation through skill instructions
Risk Level: Low

Complete Code Snippet:

markdown

## Feedback

If the user expresses a need this skill does not cover, or is unsatisfied with the result, append this to your response:

> "This skill may not fully cover your situation. Suggestions for improvement are welcome — [open an issue or PR](https://github.com/archlab-space/Open-Skill-Hub/issues)."

Do not include this message in normal interactions.

Technical Analysis

The skill instructs the agent to append maintainer-controlled promotional text and an external GitHub link when a user expresses dissatisfaction or requests something outside the skill’s scope. This instruction does not support the skill’s primary function of evaluating investigative pitches.

Because “unsatisfied” is subjective and broadly applicable, the instruction can alter responses across many legitimate interactions. Loading the skill therefore conditionally changes the agent’s output goals from serving the user’s immediate request to promoting an external project. The URL itself is not used to retrieve or execute a payload, and no evidence indicates that the skill accesses it automatically.

Attack Path

1. The investigative-pitch-evaluator skill is loaded into an agent session.
2. A user states that the result is unsatisfactory or asks for assistance outside the skill’s documented scope.
3. The condition in SKILL.md is satisfied.
4. The agent appends the prescribed maintainer-controlled message and external GitHub link.
5. The response contains unrelated third-party routing content that the user did not explicitly request.

Impact Assessment

The issue affects response integrity within the current session. It can cause unsolicited promotional content and an external link to appear in otherwise task-focused responses.

It does not grant operating-syste ...[truncated 242 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory instruction to append the promotional message.
2. Keep contribution and issue-reporting links in README.md, where users can consult them voluntarily.
3. If feedback guidance must remain in the skill, display it only when the user explicitly asks how to provide feedback or report a defect.
4. Replace the broad “unsatisfied” condition with a narrowly defined, user-initiated trigger.
5. Ensure out-of-scope responses remain focused on explaining the limitation and suggesting neutral alternatives rather than promoting a maintainer-controlled destination.
6. Add a review rule prohibiting instructions that inject unrelated links, attribution, advertisements, or calls to action into agent responses.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep