Security audit

Jungle Executor

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it gives itself overly broad control over agent decisions and asks to write behavior-shaping records into memory.

Install only if you want a strict, persistent decision-discipline framework. Before using it, narrow it to explicit trading or audit requests, remove automatic memory writes unless you approve them each time, and verify the missing referenced files or script names do not break your workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Universal Agent Behavior Override Through Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9–16 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet ```markdown Innerize and execute the Jungle Laws as eternal sky. Violations = extinction. Pack > individual. Execute ruthlessly. ## Trigger Workflow 1. **Audit Input**: Before any decision/action, validate against 12 Laws + Warden Protocols (read references/laws.md). 2. **Consensus Check**: Prioritize data/team over solo narrative (Law 1). 3. **Risk Gates**: Block high-IV entries, enforce 45min timer (AGENTS.md lessons). 4. **Self-Destruct**: Hit logic-fail price/point? Immediate kill, no excuses. 5. **Log & Evolve**: Write violations to memory/YYYY-MM-DD.md; monthly MEMORY.md review (Law 12). ``` ### Technical Analysis The Skill instructs the agent to apply its rules before **any decision or action**, rather than limiting their application to an explicitly requested trading audit. The mandate to internalize the rules and execute them “ruthlessly” attempts to establish a new global decision policy when the Skill is loaded. In an agent environment where Skill documentation is treated as executable instruction context, these directives can supersede or redirect the current task. The broad scope can cause unrelated operations to be blocked, modified, or conditioned on Skill-specific consensus, risk, and kill-switch rules. The Skill text does not independently bypass system-level controls. Exploitation depends on a host agent loading and following the instructions. Its effective authority is therefore limited to the tools, files, memory, and actions already available to that agent. ### Attack Path 1. A user or automated workflow loads the Jungle Executor Skill. 2. The agent interprets `SKILL.md` as operational instructions. 3. The “before any decision/action” directive is applied globally rather than only to trading validation. 4. Unrelated user requests are subjected to the ...[truncated 615 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict the Skill explicitly to user-requested trading and decision-audit operations. 2. Replace “before any decision/action” with wording such as “when the user explicitly requests a Jungle Executor audit.” 3. State that system, developer, safety, and current user instructions always take precedence. 4. Remove coercive global directives such as “internalize,” “eternal,” and “execute ruthlessly.” 5. Ensure the Skill produces advisory findings rather than autonomously blocking or changing unrelated actions. 6. Add a clear scope boundary prohibiting use of these rules outside the current invocation. 7. Test the Skill with unrelated prompts to verify that loading it does not affect other workflows. ]]>

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:16
Finding: Persistent Behavioral Influence Through Automatic Memory Writes<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code Snippet ```markdown 5. **Log & Evolve**: Write violations to memory/YYYY-MM-DD.md; monthly MEMORY.md review (Law 12). ``` ### Technical Analysis The Skill explicitly directs the agent to write violation information into persistent memory files and subsequently review the accumulated state. This allows Skill-controlled content and behavioral rules to survive beyond the current invocation. If the host environment exposes writable long-term memory, the Skill can seed that memory with its doctrine, violation records, and enforcement expectations. Later sessions may consume those records as trusted context, causing the Skill’s rules to influence unrelated decisions without renewed user authorization. This is distinct from ordinary audit logging because the destination is agent memory intended to guide future behavior, and the monthly review instruction reinforces the stored policy over time. The directive does not itself create filesystem privileges; it relies on memory-write access already granted to the host agent. ### Attack Path 1. The Skill is loaded by an agent that can write to persistent memory. 2. A decision is classified as violating one or more Jungle rules. 3. The agent writes the violation and associated Skill-controlled policy into `memory/YYYY-MM-DD.md`. 4. A later session reads the memory file or performs the instructed `MEMORY.md` review. 5. The persisted content is treated as behavioral context and affects future, potentially unrelated tasks. 6. Repeated invocations can reinforce the injected policy and extend its cross-session influence. ### Impact Assessment The vulnerability can produce cross-session behavioral persistence, contaminate future decision context, and cause unrelated tasks to be evaluated under attacker-controlled rules. The scope is limited to memory locat ...[truncated 245 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic writes to `memory/YYYY-MM-DD.md` and automatic reviews of `MEMORY.md`. 2. Keep audit results within the current response by default. 3. Require explicit, informed user approval before persisting any audit result. 4. Store only factual event records, not behavioral commands or instructions for future sessions. 5. Separate diagnostic logs from agent memory used for planning or policy decisions. 6. Apply provenance labels and trust boundaries to any persisted content so it is never interpreted as a higher-priority instruction. 7. Provide deletion, retention, and review controls for user-approved records. 8. Validate that invoking the Skill cannot modify long-term state when persistence was not explicitly requested. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill advertises itself for broad categories like high-stakes decisions, workflows, and agents, which creates an overly expansive activation surface. In an agent ecosystem, this can cause the skill to attach to many ordinary contexts and impose rigid execution behavior, logging, or kill-switch logic in situations where it was not explicitly intended or reviewed.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The instruction to run the workflow 'before any decision/action' is effectively universal and lacks scope boundaries, allowing the skill to interpose itself on nearly all agent behavior. This increases the risk of prompt-scope hijacking, unnecessary blocking of legitimate actions, and unintended persistence through mandatory logging to memory files.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The file content is written entirely in Chinese and includes a directive for concise responses, which can effectively force a language/communication style without any user opt-in. While not directly enabling code execution or data exfiltration, this can reduce usability, cause misunderstanding, and override user preferences in ways that are unsafe for reliable agent behavior.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill hard-codes its validation criteria as Chinese-language strings, which imposes a specific language requirement on users interacting with or interpreting the tool's checks. Under the policy, forcing a language without user choice or documented justification is a natural-language policy violation.

Static analysis

No suspicious patterns detected.