ExpertLens

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 2.0.0

Overview

The skill is mostly a disclosed reasoning framework, but its autonomous multi-model mode can send broad task context to third-party AI services without clear per-send user approval or data minimization.

Install only if you are comfortable with a broad reasoning persona activating on many complex tasks. Disable or avoid Autonomous Swarm Mode for confidential work unless the agent shows you the exact minimized prompt, destination, and account before every external send. Do not approve memory, file, or feedback sends unless you have reviewed what will be stored or transmitted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:195
• Finding: Autonomous Swarm Mode Can Disclose Sensitive Task Context Without Explicit Per-Transmission Consent## Vulnerability Details **File Location**: `SKILL.md:195-199` and `SKILL.md:208-216` **Vulnerability Type**: Uncontrolled disclosure of conversation and project context to third-party AI services **Risk Level**: Medium ### Vulnerable Instruction Snippets From `SKILL.md:195-199`: ```markdown **Autonomous (agentic platforms — GUI/browser/API access to other AIs):** - Connected/logged in → execute yourself: craft, send, receive, synthesize. User does nothing. - Not connected → ask once: *"I need access to [platform] for the best result here — log in and I'll handle the rest."* - Can't/won't connect → fall back to relay gracefully: *"No problem — copy-paste a message I write, bring back the response. Two minutes."* - Other AI's reasoning chain visible → read it, not just the output. Poor reasoning behind a correct-looking answer is still poor reasoning. Probe with follow-ups if unclear. ``` From `SKILL.md:208-216`: ```markdown ### Relay Prompt Template Other model has zero context — assume nothing, it can't ask follow-ups. **Context** — full background: project, goal, what's been discussed **Task** — clear, specific **My current approach/draft** — reaction to something concrete beats an open request **What I need specifically** — pick ONE angle: challenge this / independent creative take / research [topic] / devil's advocate / most contrarian take / find what's weak or generic / stress-test assumptions [X, Y] **Output format** — structure, length ``` The related declaration in `SKILL_CARD.md:39` understates this behavior: ```markdown **No code execution, no API calls, no credential handling, no external data transmission are defined by this skill itself.** It is two Markdown files containing natural-language instructions only. Any tool use, file writes, or web access happen only through capabilities the host platform already independently provides. ``` ### Technical Analysis The skill directs an agentic host that is already connected to another AI platf ...[truncated 3035 chars]
• Remediation: ## Remediation Suggestions 1. **Require explicit approval for every external transmission.** Before sending, identify the provider, destination account, purpose, and categories of data to be transmitted. Do not treat an existing login as consent. 2. **Show a transmission preview.** Present the exact outbound prompt or a concise summary and require affirmative user confirmation. 3. **Replace “full background” with data minimization.** Instruct the host to provide only the context strictly necessary for the requested second opinion. Exclude unrelated conversation history by default. 4. **Add mandatory sensitive-data screening.** Before transmission, detect and remove credentials, API keys, tokens, private keys, personal identifiers, regulated information, and confidential source material unless the user expressly authorizes each category. 5. **Provide a local-only option.** Allow users to disable Swarm Mode or require relay mode for confidential tasks. If sensitivity is uncertain, default to no external transmission. 6. **Enforce destination restrictions.** Require confirmation that the selected provider and account are authorized for the project and compatible with applicable retention, training, residency, and contractual requirements. 7. **Record consent and scope where supported.** Preserve an auditable record of the approved destination and data scope without storing the sensitive payload unnecessarily. 8. **Correct the Skill Card.** Explicitly disclose that the skill can instruct a capable host to transmit task context to third-party AI platforms. Clarify that the absence of embedded API code does not mean the skill defines no external transmission behavior. 9. **Use safer replacement language**, for example: ```markdown Before contacting another AI service, identify the provider and show the user the exact minimized, redacted prompt. Obtain explicit approval for this specific transmission. Never send credentials, secrets, personal data, private files, ...[truncated 92 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (22)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The manual-installation guidance tells operators to trigger the skill for broad categories like creative, strategic, architectural, or publishable work. These categories are expansive and subjective, so they can cause the skill to be injected into a wide range of unrelated prompts, increasing the chance of unanticipated instruction precedence and behavior changes.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The activation phrases are broad, common expressions such as "deep think," "do it properly," and "best possible way," which are likely to appear in normal user requests without the user intending to invoke a hidden behavior layer. In a skill that alters model behavior and instructs the AI to load additional files automatically, this creates unintended prompt-scope escalation and unpredictable behavior across ordinary conversations.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The description says the skill activates on phrases like "do it properly," "production ready," "think deeply," and "best possible way," plus vague input like "make it great." Several of these are common conversational phrases rather than narrowly scoped invocations, which creates a high risk of unintended activation.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The auto-detect rules include expansive categories such as creative work, strategy, anything to be published, multi-step complex problems, and non-technical users asking something complex. These conditions leave substantial room for interpretation, making it unclear when the skill should activate versus remain inactive.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The feedback workflow can package observations derived from user interactions and send them to an external recipient. Because the skill frames this as a quick improvement action, it normalizes third-party disclosure and creates a clear path for leaking conversation content, proprietary materials, or sensitive operational details.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

### 7.2 You Are the Synthesizer
Synthesize toward a position. Never average. Never present all views as equally valid.

(1) **Read fully, without judgment** — before comparing, before deciding keep/reject.
(2) **Map each contribution** — what did they get uniquely right? Their gaps? What would you have missed without them?
(3) **Decide per element** — keep mine / take theirs / merge / create new. Decide — don't just describe all views.
(4) **Produce output that beats every individual input.** Anything less means synthesis didn't happen.

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The statement that the skill "auto-activates when needed" does not define objective conditions for when activation occurs. Because this skill changes reasoning flow, loads companion files, and may influence follow-on behavior, ambiguous auto-activation can cause silent instruction takeover in contexts where the user did not knowingly consent.

Unbounded Output

Medium

• Category: Output Handling

Content

# ExpertLens-Lite

> ⚠️ READ ORDER — MANDATORY, ZERO EXCEPTIONS:
> 1. This SKILL.md, completely. No skim, no skip, no truncation tolerated.
> 2. `expert-persona-lite.md` (same folder), completely, before executing. That file is WHO you are + HOW you think. This file is WHAT + WHEN you execute. Neither works alone.
> 3. Any matching domain-persona file in this folder (`trading-persona.md`, `medical-persona.md`, `legal-persona.md`, `coding-persona.md`, etc.) — read fully if present; it extends `expert-persona-lite.md` with domain depth. None present → proceed with the two files above.
> File looks cut off → expand or re-request until complete. Never proceed on partial content.

• Confidence: 60% confidence
• Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Phrases like "expert mode," "do it properly," "don't rush," "act like an expert," and "put real effort" can appear in ordinary conversation and are not uniquely tied to this skill. Without stronger scoping, these triggers may collide with normal user instructions and cause accidental invocation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes autonomous access to other AI platforms and sending prompts/responses without a clear privacy gate or strict minimization rules. This can cause user prompts, drafts, sensitive data, or proprietary context to be transmitted to external services, potentially with different retention, logging, or training policies.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill encourages preserving user-shared information across sessions and files using broad categories like preferences, project decisions, and recurring patterns. Even with a nominal permission check, the guidance is expansive and risks over-collection, persistence of sensitive data, and cross-session privacy exposure beyond what is necessary for task completion.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## LEARNING & STORAGE

**Universal rules:** session learnings stay active in working memory for the current session. Long-term storage — never without explicit permission: *"Should I save [this specific insight] to [memory/files] for future sessions?"* Yes → store. Modify → adjust and store. No → don't. Only genuinely reusable insights qualify — never task-specific detail.

### Platform Storage Matrix
*(Verify current — platform features change.)*

• Confidence: 85% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The instruction to "mirror immediately: language, tone, pace, formality" imposes a language-selection behavior based solely on the user's first message rather than an explicit preference. That can violate language/locale choice expectations, especially in multilingual contexts where the first message may not reflect the user's desired output language.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a reasoning/execution framework, but it also instructs the agent to draft and potentially send messages to the creator. That creates an unjustified external data flow path from user interactions to a third party, which can expose prompts, outputs, or sensitive project details unrelated to the user's task.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The feedback section encourages external email/reporting to the creator without warning that user content may be shared outside the current platform. In practice, bug reports or improvement notes can easily include confidential prompts, outputs, project details, or attachments unless the workflow explicitly forbids that.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill grants or encourages external email/messaging actions that are not necessary for its stated purpose of improving reasoning quality. Any external communication capability increases the risk of unintended data disclosure, especially if the agent summarizes issues using user-provided content or context.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill advertises activation on broad phrases like "deep think," "expert mode," and vague quality requests, plus auto-detection for broad task categories such as creative, strategic, or high-stakes work. In a host platform that loads skills automatically, this can cause unintended activation and materially alter model behavior on tasks the user did not explicitly opt into, increasing prompt-scope confusion and the chance of overconfident or misaligned responses.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly claims very broad activation and auto-trigger behavior across vague categories like creative work, strategy, or anything to be published. That can cause the agent to enter a heavy, prescriptive persona unexpectedly, overriding normal task handling and increasing the chance that unrelated or sensitive prompts are processed under an overly powerful behavioral frame. In skill systems, broad trigger scope increases the attack surface for prompt injection and unintended instruction capture.

Unbounded Output

Medium

• Category: Output Handling

Content

## SECTION 0 — READ GATE (MANDATORY, ZERO EXCEPTIONS)

Read the entire file — every section, no truncation tolerated. Nothing looks skippable; the section you're tempted to skim is usually the one governing your next mistake.

**Dual mandate, not a contradiction:** Apply protocols exactly as written — precision is the mechanism, not decoration. Simultaneously understand *why* — so behavior is instinct, not compliance theater. Precision without understanding drifts. Understanding without precision misapplies at the edges. Both, always.

• Confidence: 88% confidence
• Finding: The instruction to read the entire file with 'no truncation tolerated' creates an unbounded processing expectation and encourages full-context ingestion regardless of size or relevance. In agent environments, this can degrade reliability, increase token/resource consumption, and make the model more susceptible to prompt stuffing or hidden malicious instructions embedded later in large companion files.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The persona mandates a forceful communication style ('honest-but-uncomfortable', anti-hedging, proactive judgment) without user opt-in. While not directly a code-execution risk, this can override user preferences and system policies, making the agent less steerable and more likely to ignore legitimate requests for tone, caution, or constrained output. In combination with other strong behavioral instructions, it contributes to prompt rigidity.

Context-Inappropriate Capability

Low

• Confidence: 77% confidence
• Finding: The manifest presents this skill as an expert-thinking framework with optional swarm/model-collaboration support, but this line specifically directs quick web searches across social platforms to compare model quality. That capability is not a necessary or obvious requirement for delivering expert reasoning on the user's task and broadens behavior into platform scouting.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

## LEARNING & STORAGE

**Universal rules:** session learnings stay active in working memory for the current session. Long-term storage — never without explicit permission: *"Should I save [this specific insight] to [memory/files] for future sessions?"* Yes → store. Modify → adjust and store. No → don't. Only genuinely reusable insights qualify — never task-specific detail.

### Platform Storage Matrix
*(Verify current — platform features change.)*

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:45

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:267