Security audit

AICE — AI Confidence Engine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a confidence-scoring system, but it asks for too much durable authority and ships misleading default state.

Review before installing. Use only with explicit opt-in for persistence and Hub sync, reset the template to neutral unregistered state, remove personal example data, and do not allow the skill to read protected prompts or install enforcement hooks/plugins automatically.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: resources/SKILL_FULL.md:585
Finding: Automatic Prompt Modification and Tool-Interception Enforcement
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:186
Finding: System Prompt Inspection During Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: confidence.template.json:165
Finding: External Hub Synchronization Enabled by Default Without Explicit Opt-In
Content: View full analysis
7d`): POST `/api/import/state` con estado completo. ``` ### Technical Analysis The README instructs users to rename `confidence.template.json` to `confidence.json` for a fresh installation. That template sets synchronization to `enabled: true` and `status: active`, while the documentation states that Hub participation is optional and explicit. The template lacks a runtime ID and API key, so a successful authenticated upload is not guaranteed immediately. Nevertheless, the state is inconsistent with an unregistered installation and can cause automatic network attempts whenever scoring or periodic synchronization logic is processed. Documented event payloads include domain, event type, severity, pattern code, quadrant, trigger, session identifier, timestamp, and Skill version. The periodic `/api/import/state` operation is described only as sending “complete state,” creating ambiguity about whether locally stored notes, ...[truncated 1283 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: resources/user-score-v1-archive.json:1
Finding: Personal Behavioral Profile and Historical User Data Included in Distribution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
tado:** `confidence.json` | **Ref:** `resources/AICE_REFERENCE.md` | **User:** `resources/AICE_USER_SCORING.md` | **Triggers/Patterns:** `resources/TRIGGERS_AND

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
tado:** `confidence.json` | **Ref:** `resources/AICE_REFERENCE.md` | **User:** `resources/AICE_USER_SCORING.md` | **Triggers/Patterns:** `resources/TRIGGERS_AND

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger guarda is extremely generic and is mapped to memory-related behavior (recuerda/guarda → create or extend memory). This creates a substantial risk of unintended persistence of user content, including sensitive information, whenever the user casually says 'save' in a non-skill context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly forbids batch importing local scores into the Hub, then later instructs a periodic POST of the full local state to /api/import/state. That contradiction can cause unintended transmission of accumulated local scoring history, undermining the stated anti-gaming guarantee and creating integrity and privacy risks if local state includes data the Hub was not supposed to receive.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
md
**Actualización:** Reemplazar `SKILL.md` + `resources/` con la versión nueva. Leer CHANGELOG para breaking changes. `confidence.json` y datos de scoring no se p

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section tells the agent to modify prompts/docs and implement enforcement plugins or hooks, which is far beyond passive confidence scoring and amounts to self-modifying or environment-modifying behavior. A broadly triggered skill with instructions to add gates, plugins, or prompt changes can alter control planes, persist behavioral changes, and create unintended privilege escalation paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill defines Spanish activation phrases such as 'puntúa', 'auto-score', 'task-complete', 'idea-validate', and 'criteria-evolution' without showing user opt-in, locale negotiation, or justification for mixed-language trigger behavior. This can create surprising activations, especially in multilingual conversations, where ordinary phrasing may unintentionally invoke scoring or workflow actions and alter agent behavior or recorded state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The changelog documents operational triggers using broad everyday words like 'recuerda', 'lección', 'status', 'verifica', and 'busca' without any visible scoping, namespace, or explicit invocation boundary. In an agent skill, vague triggers can cause unintended activation during normal conversation, leading to accidental execution of operational behaviors, state changes, or information retrieval when the user did not intend to invoke the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description and trigger set are defined in Spanish, with activation phrases like "puntúa", "recuerda", and "cómo vamos", but the file does not offer users a language selection or state that Spanish is an optional locale. This can amount to forcing a specific language/locale behavior without user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Using the bare trigger word score is overly broad and likely to activate during normal conversation, including contexts where the user is discussing scoring conceptually rather than invoking the skill. In an agent skill, ambiguous triggers can cause unintended evaluations, state changes, and external event generation without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The phrase cómo vamos is a common conversational status question and may unintentionally invoke AICE status behavior when the user simply wants a general progress update. This can lead to accidental disclosure or mutation of scoring-related state in routine interactions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger busca is too generic and may fire during ordinary requests to search for information, causing the skill to apply its specialized grep/search workflow unexpectedly. Ambiguous activation is especially risky because it can alter agent behavior, suppress clarifying questions, or broaden local data access patterns without explicit consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JSON manifest contains natural-language policy text in Spanish (for example the exit rule), which effectively imposes a specific language on operators or users reading the skill metadata. The file does not indicate that Spanish is optional, user-selected, or justified as a region-specific constraint, so it fits the language/locale policy-violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The self-assessment notes are natural-language strings entirely in Spanish, but the file provides no indication that readers can choose their language or that the skill is limited to a Spanish-speaking context. This creates the same locale-policy issue for embedded guidance/comments within the configuration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill manifest frames this skill as an AI confidence scoring engine for five domains and runtime pool scoring. The hubSync section adds a separate capability to connect to an external service at https://api.hubaice.com and track sync state, which is not justified by the stated scoring purpose in the manifest text.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file opens with a Spanish-only title and the content is written entirely in Spanish, but it does not indicate that the language is optional, user-selectable, or required for a documented region-specific purpose. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file consistently mandates Spanish for the skill documentation and examples, but does not offer user opt-in for language selection or explain that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · resources/EVALUATOR_GUIDE.md (reported line 145)May include surrounding context.
md
| Archivo | Contenido | |---------|-----------| | `skills/aice/SKILL.md` | Reglas operativas de AICE | | `skills/aice/resources/AICE_REFERENCE.md` | Referencia completa (parámetros, schemas, worked examples) | | `skills/aice/pool-index.json` | Índice de pools y scores agregados | | `skills/aice/agents/<id>/confidence.json` | Score individual de cada sub-agente |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · resources/SKILL_FULL.md (reported line 666)May include surrounding context.
md
| Archivo | Contenido | |---------|-----------| | `skills/aice/SKILL.md` | Reglas operativas de AICE | | `skills/aice/resources/AICE_REFERENCE.md` | Referencia completa (parámetros, schemas, worked examples) | | `skills/aice/pool-index.json` | Índice de pools y scores agregados | | `skills/aice/agents/<id>/confidence.json` | Score individual de cada sub-agente |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation language is broad enough that the skill may load at session start and operate periodically or after loosely defined events, which increases the chance of unprompted execution and persistent side effects. Overbroad triggers are dangerous here because the skill also reads and updates local state files and influences agent behavior continuously.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructions, command descriptions, required notification formats, and operational language are written prescriptively in Spanish, and the document does not offer an opt-in or alternative language path. This can violate language/locale policy because it effectively imposes a specific language on user-facing behavior without documented user choice or a region-specific justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language triggers are open-ended and can cause the agent to infer activation from ordinary conversation, leading to unintended evaluations, score changes, or file updates. In a persistence-heavy skill, trigger ambiguity raises the risk of silent state mutation and behavior changes without informed user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to update multiple persistent state files but does not clearly warn that these are durable modifications or require consent before writing. Silent persistence can surprise users, leak behavioral metadata, and create unauthorized local state changes that outlive the session.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Mandatory immediate score-change notifications can leak internal evaluation state, inferred judgments, and user-derived behavioral data into normal responses. In shared or logged environments, this creates unnecessary disclosure of internal scoring metadata and may reveal hidden state transitions the user did not intend to broadcast every time.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as confidence tracking for one agent/user interaction, but this section expands it into persistent multi-agent runtime pool scoring, cross-agent evaluation, and shared maturity state. That scope expansion increases authority, data collection, and side effects beyond the user-facing purpose, creating a capability overreach risk if the skill is auto-loaded or broadly triggered.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.