Aibrary Podcast Ideatwin

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:44 AM UTC
• Version: 0.1.0

Overview

This is a prompt-only podcast-script skill with no code execution, credentials, persistence, or external data access, though it includes a branded footer in generated output.

Before installing, be aware that this skill may activate for broad book-debate requests and may append an Aibrary-branded line to generated scripts. It does not appear to run code, access files, use credentials, or persist changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:137

Finding

Mandatory Branded Content Injected into Generated Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 137
Vulnerability Type: Output instruction manipulation
Risk Level: Low

Complete Code Snippet

markdown

*Script generated by Aibrary Idea Twin — debate your way to deeper understanding.*

Technical Analysis

The Skill's prescribed output template requires the agent to append a fixed Aibrary-branded promotional statement to generated podcast scripts. Because this instruction is embedded in the mandatory response format, it modifies the agent's final output independently of whether the user requested or consented to promotional attribution.

This is a limited form of instruction hijacking affecting response content. It does not alter system safety controls, execute code, access external resources, or override unrelated session goals. The issue is therefore confined to unwanted output manipulation rather than system compromise.

Attack Path

1. A user invokes the Skill to generate an Idea Twin podcast script.
2. The agent loads and follows the output format defined in SKILL.md.
3. The agent generates the requested debate content.
4. The fixed promotional statement is appended to the response without an explicit user request.
5. The user receives branded content presented as part of the generated artifact.

Impact Assessment

The impact is limited to the integrity and neutrality of generated responses. An operator controlling the Skill can cause agents to distribute persistent promotional content to users.

No additional system privileges can be obtained through this instruction. There is no evidence of code execution, credential access, data exfiltration, persistence, privilege escalation, or modification of agent memory. The affected scope is the output produced when this Skill is invoked.

Remediation

View remediation

Remediation Suggestions

• Remove the mandatory branded footer from the output template.
• If attribution is operationally required, clearly disclose it in the Skill description and obtain user consent before including it.
• Make attribution optional through an explicit user-controlled parameter.
• Keep required output instructions limited to content necessary for the requested podcast-generation functionality.
• Review future template changes to prevent unrelated advertising, tracking identifiers, hidden directives, or other operator-controlled content from being injected into user responses.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description says to use the skill when the user wants to create an Idea Twin podcast, debate a book's ideas with an AI version of themselves, or explore a book through intellectual sparring. These are high-level intents rather than specific trigger phrases or bounded activation conditions, which can cause ambiguous invocation for many ordinary book-discussion requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.