Security audit

text-patterns

Security checks for vulnerabilities and agentic risk

Overview

This text-processing skill is mostly coherent, but it can fetch changing remote prompt instructions from GitHub and treat them as controlling instructions without strong user consent or integrity checks.

Install only if you are comfortable with the agent using Fabric patterns and, when local patterns are missing, fetching live instructions from Daniel Miessler's GitHub repository. Prefer vendored or pinned pattern files, ask before any network fetch, and avoid using it automatically on sensitive documents unless you confirm which pattern and source will be used.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The README advertises activation on very common phrases like 'summarize this' and 'extract insights', which are ordinary user requests that could appear in many contexts. That can cause the skill to activate unintentionally and route user content through this skill when the agent did not mean to invoke it, increasing the chance of prompt/instruction crossover and incorrect handling of sensitive text.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The Chinese trigger phrases are also everyday language such as requests to summarize or polish text, without a clear boundary indicating when the skill should or should not run. In multilingual environments this broad matching expands the accidental activation surface and can make the agent apply pattern instructions in situations where the user only intended ordinary conversation help.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill description states the fallback has 'no external dependency', but the body later directs the agent to download pattern instructions from GitHub when local files are absent. This discrepancy can mislead operators and users about the skill's actual trust boundary and network behavior, increasing the chance that remote content is fetched without appropriate scrutiny.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to retrieve executable prompt instructions from a remote GitHub URL at runtime, which expands a local text-processing skill into one with network-driven behavior. This creates a supply-chain and prompt-injection risk because remote `system.md` content can change over time and may cause the agent to follow unreviewed instructions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to fetch and process external content from GitHub without prominently warning the user that third-party data will be retrieved and then used as controlling instructions. In this context, the danger is elevated because the fetched content is not merely displayed but treated as authoritative prompt material, which can influence downstream behavior.

Static analysis

No suspicious patterns detected.