furniture-fit

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:39 PM UTC
• Version: 1.0.0

Overview

This skill is a clearly scoped furniture-fit helper for Pascal that discloses its optional setup, credential, network, and mutation paths and repeatedly requires user authorization before changes.

Install only if you intend to use Pascal for furniture-fit checks. Use local mode when projects should remain on your machine, use a Pascal API key only for hosted projects, and treat any save, placement, hosted link, or separate agent workspace as something that needs your explicit approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Ae1

High

• Category: analysis-evasion

Content

If Pascal is not connected, use [references/setup.md](references/setup.md). This skill is standalone; no other skill must be installed.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

Claude Code:

Plugin users set the key once in the configuration prompt shown when `pascal-agent-skills@pascal` is enabled. To add or change it later, reinstall with `claude plugin install pascal-agent-skills@pascal --config pascal_api_key=<key>`, or open `/plugin` in a session and use its configure flow; there is no `claude plugin config` command. The hosted tools then load under the plugin's `pascal-hosted` server beside the local `pascal` server, and Claude Code keeps the key in the OS keychain, falling back to `~/.claude/.credentials.json`, rather than writing it into `settings.json` or any project file.

Without the plugin, register the hosted endpoint manually:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Existing hosted project

Create an API key in Pascal Settings (`https://editor.pascal.app/settings`) for the same user or organization that owns the target project. Set `PASCAL_API_KEY` to that key without printing it. If you assign it in a shell command, avoid or remove that command from shell history. The hosted Streamable HTTP endpoint is:

```text
https://editor.pascal.app/api/mcp

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Low

• Confidence: 79% confidence
• Finding: This JSON eval file contains many natural-language prompts phrased as ordinary user requests such as 'Check if it fits', 'tell me if I should order it', and 'Give one read-only next action' without any explicit trigger boundaries or exclusion conditions. In a manifest/plain-text context, this kind of broad activation wording can overlap with common conversation and does not define when the skill should or should not activate.

Natural-Language Policy Violations

Low

• Confidence: 67% confidence
• Finding: Several eval cases instruct the agent to provide or withhold a 'Pascal' link and to send measurements to Pascal, which hard-codes a specific service path in user-facing behavior. If interpreted as organizational language policy, this constrains the user to a specific platform without presenting an opt-in alternative beyond a few scenario-specific authorizations.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The trigger evals give representative positive and negative examples, but they do not clearly define the activation boundary for ambiguous requests such as delivery-route claims, unsupported proofs, or mixed aesthetic-plus-fit queries. In a routing system, this can cause the skill to trigger too broadly or too narrowly, leading to incorrect tool use, unsupported spatial conclusions, or failure to defer when evidence is insufficient.

Static analysis

No suspicious patterns detected.