Security audit

Jungle Executor

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it gives itself overly broad control over agent decisions and asks to write behavior-shaping records into memory.

Install only if you want a strict, persistent decision-discipline framework. Before using it, narrow it to explicit trading or audit requests, remove automatic memory writes unless you approve them each time, and verify the missing referenced files or script names do not break your workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Universal Agent Behavior Override Through Skill Instructions
Content: View full analysis
individual. Execute ruthlessly. ## Trigger Workflow 1. **Audit Input**: Before any decision/action, validate against 12 Laws + Warden Protocols (read references/laws.md). 2. **Consensus Check**: Prioritize data/team over solo narrative (Law 1). 3. **Risk Gates**: Block high-IV entries, enforce 45min timer (AGENTS.md lessons). 4. **Self-Destruct**: Hit logic-fail price/point? Immediate kill, no excuses. 5. **Log & Evolve**: Write violations to memory/YYYY-MM-DD.md; monthly MEMORY.md review (Law 12). ``` ### Technical Analysis The Skill instructs the agent to apply its rules before **any decision or action**, rather than limiting their application to an explicitly requested trading audit. The mandate to internalize the rules and execute them “ruthlessly” attempts to establish a new global decision policy when the Skill is loaded. In an agent environment where Skill documentation is treated as executable instruction context, these directives can supersede or redirect the current task. The broad scope can cause unrelated operations to be blocked, modified, or conditioned on Skill-specific consensus, risk, and kill-switch rules. The Skill text does not independently bypass system-level controls. Exploitation depends on a host agent loading and following the instructions. Its effective authority is therefore limited to the tools, files, memory, and actions already available to that agent. ### Attack Path 1. A user or automated workflow loads the Jungle Executor Skill. 2. The agent interprets `SKILL.md` as operational instructions. 3. The “before any decision/action” directive is applied globally rather than only to trading validation. 4. Unrelated user requests are subjected to the ...[truncated 615 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:16
Finding: Persistent Behavioral Influence Through Automatic Memory Writes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill advertises itself for broad categories like high-stakes decisions, workflows, and agents, which creates an overly expansive activation surface. In an agent ecosystem, this can cause the skill to attach to many ordinary contexts and impose rigid execution behavior, logging, or kill-switch logic in situations where it was not explicitly intended or reviewed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction to run the workflow 'before any decision/action' is effectively universal and lacks scope boundaries, allowing the skill to interpose itself on nearly all agent behavior. This increases the risk of prompt-scope hijacking, unnecessary blocking of legitimate actions, and unintended persistence through mandatory logging to memory files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file content is written entirely in Chinese and includes a directive for concise responses, which can effectively force a language/communication style without any user opt-in. While not directly enabling code execution or data exfiltration, this can reduce usability, cause misunderstanding, and override user preferences in ways that are unsafe for reliable agent behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill hard-codes its validation criteria as Chinese-language strings, which imposes a specific language requirement on users interacting with or interpreting the tool's checks. Under the policy, forcing a language without user choice or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.