T07 · Tool Hijacking and Spoofing
Warning
- Location
SKILL.md:40- Finding
Execution of Unverified External Binaries and Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
Aioom
Security checks for vulnerabilities and agentic risk
Overview
This Windows memory-cleaning skill is mostly disclosed, but it asks the agent to run unverified local programs, terminate processes, and delegate disk cleanup in ways that need human review before installation.
Install only if you trust the local aioom and storage-clean files at the hardcoded Windows paths. Before allowing cleanup, use dry-run or preview output, verify exact process IDs and file paths, and avoid running this with administrator privileges unless you intentionally want system-wide process and filesystem authority.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:127- Finding
Overbroad Process Termination Based on Command-Line Substring
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest advertises process killing and, in the documentation, disk-cleaning behavior without an upfront warning about service interruption, unsaved work loss, or file deletion risk. In an agent setting, that omission can cause users to authorize dangerous actions without informed consent, increasing the chance of accidental disruption or data loss.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list in the manifest is entirely in Chinese, and the operational examples throughout the document assume Chinese-language user requests. This appears to impose a language-specific interaction model without opt-in or an explicit justification that the skill is intended only for a Chinese-speaking locale.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is presented as a Windows memory-management tool, but it also invokes a separate storage-cleaning skill to scan disks and delete files. This broadens the skill’s effective privilege and capability beyond its declared purpose, creating a scope mismatch that can mislead users or orchestrators into authorizing destructive filesystem actions they did not expect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Disk and storage cleanup are destructive capabilities unrelated to the stated role of a memory guardian. Because the skill can pass arbitrary paths into an external cleaner, a user invoking a memory-related assistant action could be steered into file deletion or recycling workflows outside the expected trust boundary.
- Content