T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:144- Finding
Untrusted Project Voice Overrides Are Elevated to Authoritative Prompt Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
voice-generate
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a coherent writing-voice generator, but it automatically trusts local project files and unvalidated register names in ways that can read or apply unintended Markdown instructions.
Install only if you trust the projects where you use it and understand that it may read local voice-profile files plus `.voice/override.md`. Avoid using it in untrusted repositories, and prefer profiles/registers with strict filename validation and an explicit review of any project override before generation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
modules/register-selection.md:27- Finding
Unvalidated Register Name Permits Path Traversal Outside the Registers Directory
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 ;; esac ``` 2. Prefer selecting the requested register from an enumerated list of files already discovered inside the register directory rather than constructing a path from raw input. 3. Canonicalize the register directory and candidate path with a platform-appropriate utility such as `realpath`. 4. Verify that the canonical candidate remains a direct child of the canonical register directory before reading it. 5. Reject absolute paths, directory separators, traversal sequences, control characters, and symbolic-link escapes. 6. Consider requiring regular files owned by the expected user and disallowing symbolic links. 7. Apply equivalent validation to `PROFILE_NAME` if it can be influenced by users or repository content. 8. If validation fails, report the invalid name and use the known canonical `default.md` path rather than probing the attacker-supplied path. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes generic terms like "voice," "generation," and "writing," which are broad enough to cause accidental or overly frequent invocation outside the intended style-transfer use case. In an agent ecosystem, that increases the chance this skill activates on unrelated prompts and then performs profile loading and file reads unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs reading from $HOME/.claude/voice-profiles and optional project-local .voice/override.md without any user-facing disclosure, confirmation step, or access boundary. That creates a confidentiality risk because the agent may ingest local data the user did not realize would be accessed, including sensitive writing samples or project-specific content.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 82% confidence
- Finding
The instruction to always frame source material as "rough notes" unless the user overrides changes the semantic presentation of user input in a way that can steer model behavior without transparent consent. This is a form of prompt-level manipulation that may distort user intent, suppress structure the user provided, and produce outputs that misrepresent the source material.
- Content
Load:
@modules/source-framingDefault framing (always use unless user overrides):
text Below are my rough notes on this topic. I'm still thinking
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module explicitly describes 'Auto-Fix Rules (Silent)' that alter generated text before any review or user disclosure. In a voice/style-transfer pipeline, silent rewriting can change meaning, tone, or factual nuance while making the output appear author-authentic, which creates integrity and attribution risks even if the substitutions seem minor.
- Content
Static analysis
No suspicious patterns detected.