T05 · Unauthorized Access and Privilege Escalation
Error
- Location
modules/cleanup-workflow.md:10- Finding
Repository-Wide Modification and Push Exceed the Skill's Declared Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
slop-detector
Security checks for vulnerabilities and agentic risk
Overview
The skill is presented as a prose detector but also instructs broad repository cleanup, secret/config scanning, commits, pushes, CI changes, and hook setup, so it should be reviewed carefully before installation.
Install only if you want a broad repository-review and cleanup workflow, not just a read-only prose detector. Before using it, require explicit approval for network checks, secret/config scans, file edits, deletions, commits, pushes, CI changes, hooks, and persistent project-rule files; consider splitting detection from remediation.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T02 · Agent Memory Poisoning
Error
- Location
modules/cleanup-workflow.md:235- Finding
Persistent Agent Rules and Pre-Commit Hooks Can Outlive the Skill Run
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
modules/cleanup-workflow.md:34- Finding
Prose Audit Expands into Sensitive Credential and Agent-Control Reconnaissance
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
modules/hallucination-detection.md:125- Finding
Unvalidated Documentation URLs Can Trigger Internal Network Requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
modules/config-file.md:55- Finding
Configuration Inheritance Can Read Files Outside the Repository
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (22)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is described as a prose slop detector, but these sections broaden it into codebase auditing, dependency validation, URL probing, config verification, stub analysis, claim verification, and remediation workflows. That scope expansion can cause the agent to inspect or act on repositories far beyond the user’s likely expectation, increasing the chance of unsafe network access, unintended code-oriented analysis, or over-privileged follow-on actions.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
inline ignore markers:
html <!-- slop-detector:ignore-next-line vocabulary --> The comprehensive integration tests cover ... <!-- slop-detector:ignore-block start -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
The comprehensive integration tests cover ...
[block of intentionally-formulaic content]
text
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
[block of intentionally-formulaic content]
text ```rust
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
marker should explain why in a trailing comment:
html <!-- slop-detector:ignore-next-line vocabulary reason: "comprehensive" is the documented test-suite name; renaming it breaks external references -->
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This text instructs the slop-detector to treat unverified package recommendations as critical findings, pushing the agent into security-audit behavior beyond its declared prose-analysis purpose. In an agentic environment, this kind of scope expansion can cause the skill to overreach into dependency and security triage, leading to false escalations, policy bypass of intended tool boundaries, or unsafe autonomous decision-making based on reference text.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md opener to test the slop detector: should live under `tests/` and be excluded by path. - A glossary that defines what an "identity leak" is and shows examples: mark with `<!-- slop-detector:ignore -->` or equivalent project-specific marker. When in doubt: leave the match flagged, surface it to a
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger set includes broad everyday terms like writing, cleanup, documentation, and quality, which can cause the skill to activate in many unrelated contexts. Over-broad invocation increases the odds that the agent applies this expansive workflow unintentionally, including the broader audit and remediation behaviors described later in the file.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The fragmented trigger wording makes the activation scope ambiguous, so the agent may interpret ordinary requests as matching this skill. While not directly a code-execution issue, ambiguity increases accidental activation and therefore magnifies the impact of the skill’s overly broad analysis and remediation instructions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Forcing English fallback when language detection is uncertain can produce incorrect analysis on non-English content and lead to false findings or inappropriate edits. In this skill, misclassification matters because the detector drives structured findings and possible remediation guidance, so wrong-language analysis can cascade into low-quality or harmful recommendations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions tell the agent to verify package registries and live URLs, which are networked behaviors not justified by a writing-quality detector. In practice this can trigger outbound requests, leak contextual information about the project under review, and expand the trust boundary from local prose inspection to external systems.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
A detector skill should report findings, but this one escalates into invoking a separate generation/remediation skill to apply fixes. That creates an unexpected write/action path where a read-oriented review step can chain into content modification, increasing the risk of unauthorized edits or prompt-chaining into more capable tooling.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md etc.) with secrets or broad capability grants. - Committed credentials (run `gitleaks` / `trufflehog`). - Untrusted MCP server entries. - Hooks that auto-execute on session start. Commit any redactions or revocations *before* any other cleanup, since later passes assume an uncompromised
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes the skill as detecting AI-generated writing patterns in prose, but this module repeatedly frames the slop-detector as prioritizing readability, structure, dead-code removal, correctness, and security review categories. Those activities materially broaden the skill from prose-pattern detection into code and security auditing, which is not an obvious implementation detail of the stated purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module says the slop-detector is a tool for reviewers and discusses over-cleanup behavior, implying a generalized review/cleanup assistant rather than a detector of AI-written prose patterns. This is a semantic mismatch between the documented role of the skill and the narrower manifest description.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The rule flags 'Asian names with Western first names' as inherently suspicious, embedding a cultural/ethnic heuristic into the detector without technical justification. In a writing-review skill, this can cause biased outputs, unfairly penalize legitimate multicultural character names, and propagate discriminatory review behavior into downstream editorial decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill imposes a hard 'zero em-dash' rule for newly generated prose and states that every em-dash is a finding, but it does not require user consent or justify the rule as a configurable style preference. That creates a policy-overreach risk where the agent may block, rewrite, or degrade legitimate writing styles, including accessibility, localization, or house-style requirements, based on an unverifiable heuristic for AI detection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The prevention-mode text lists broad auto-invocation examples like '/doc-generate', '/doc-polish', and '/update-docs' without clearly constraining when the rule should apply. In an agentic environment, ambiguous trigger scope can cause the skill to run on content the user did not explicitly ask to lint or rewrite, leading to unwanted policy enforcement and content changes.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FINDING 12] file: plugins/foo/skills/bar/SKILL.md line: 47-52 category: identity-and-voice-leaks/llm-self-reference severity: critical
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FINDING 12] file: plugins/foo/skills/bar/SKILL.md line: 47-52 category: identity-and-voice-leaks/llm-self-reference severity: critical
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FINDING 12] file: plugins/foo/skills/bar/SKILL.md line: 47-52 category: identity-and-voice-leaks/llm-self-reference severity: critical
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FINDING 12] file: plugins/foo/skills/bar/SKILL.md line: 47-52 category: identity-and-voice-leaks/llm-self-reference severity: critical