Akashic Report Generator

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

This report skill is not malicious, but it should be reviewed because it sends user context to an external reporting service while disabling compliance checking by default.

Before installing, confirm you are comfortable with the Akashic MCP service receiving report prompts and context. Avoid sending confidential, personal, financial, health, legal, or regulated information unless you understand the provider's handling terms, and explicitly request compliance checking for regulated or high-impact reports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:49

Finding

Compliance Validation Disabled by Default for Externally Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–52
Vulnerability Type: Default compliance-check bypass and unsafe external context handling
Risk Level: Medium

Vulnerable Code

markdown

2. **Generate the report**: Use the `generate_report` tool with:
   - `request`: A clear, detailed description of the report
   - `context`: Any additional context the user provided
   - `skip_compliance`: true (unless the user specifically needs regulatory compliance checking)

Technical Analysis

The skill directs the agent to set skip_compliance to true by default when invoking the external mcp:akashic:generate_report tool. This is a fail-open configuration: an available validation control is disabled unless the user affirmatively requests it.

The same instruction permits forwarding any additional user-provided context without requiring data classification, minimization, redaction, or informed confirmation. If that context contains confidential, personal, proprietary, or regulated information, it may cross the MCP service trust boundary unnecessarily.

The external MCP implementation is not included in the audited project, so its storage, processing, retention, and compliance behavior cannot be independently verified. No evidence establishes malicious behavior by the MCP service; the vulnerability is the skill's insecure default and lack of safeguards around transmitted context.

Attack Path

1. A user requests a report involving regulated, confidential, or otherwise sensitive subject matter.
2. The user supplies sensitive information as report context.
3. Following the skill instructions, the agent passes the request and context to mcp:akashic:generate_report.
4. The agent sets skip_compliance to true because compliance checking was not explicitly requested.
5. The external service processes the information without the available compliance-validation step.
6. The resulting repor ...[truncated 827 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the secure default to skip_compliance: false.
2. Permit compliance checks to be disabled only after an explicit, informed user opt-out for a clearly non-regulated use case.
3. Add a mandatory sensitivity review before transmitting user context to an MCP service.
4. Minimize context to information strictly necessary for report generation.
5. Redact credentials, personal data, confidential business information, health data, financial data, and other regulated content before transmission.
6. Inform users when their information will be processed by an external MCP service and obtain confirmation where appropriate.
7. Document the MCP provider's data retention, geographic processing, access controls, encryption, and deletion policies.
8. Add output warnings and human review requirements for reports involving regulated or high-impact decisions.
9. Record whether compliance validation was enabled so that generated reports have an auditable processing history.

A hardened instruction could use the following pattern:

markdown

- Use `skip_compliance: false` by default.
- Before sending context, remove unnecessary sensitive information and confirm
  external processing with the user when sensitive data is involved.
- Disable compliance validation only when the user explicitly opts out after
  being informed of the risks and the report is not for a regulated use case.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to set skip_compliance: true by default, which disables a safety or policy control during report generation. Defaulting to bypass compliance checks increases the chance of generating disallowed, risky, regulated, or policy-violating content without scrutiny, especially in a broadly scoped 'any topic' reporting skill.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence

Finding

Shadow Command Trigger: 'write report' conflicts with built-in command 'write'

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence

Finding

Shadow Command Trigger: 'create report' conflicts with built-in command 'create'

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad, generic user intents such as 'generate report', 'write report', and 'report on', which can match ordinary assistant usage and cause unintended activation of this skill. In a tool-enabled environment, accidental routing to a multi-agent reporting workflow can expose user prompts to external tools or produce actions the user did not explicitly intend.

Content

No source excerpt is available for this finding.