Mythos

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 0.1.1

Overview

The skill is a reasoning helper, but it also recommends persistent global agent behavior changes and unpinned external script execution that users should review first.

Install the /mythos command only if you want a reasoning-workflow skill that may use parallel subagents. Do not add the CLAUDE.md snippet unless you intentionally want it to affect all future non-trivial agent requests, and avoid running the external calibration scripts unless you first inspect them and pin or verify the source revision.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: references/mythos-init.md:3
• Finding: Persistent Global Agent Behavior Modification Through CLAUDE.md<![CDATA[ ## Vulnerability Details **File Location**: `references/mythos-init.md`, lines 3-12 **Vulnerability Type**: Persistent agent-state modification **Risk Level**: Medium ### Vulnerable Code Snippet The document instructs the user to add the following persistent configuration to `CLAUDE.md`: ```markdown ## Reasoning Protocol (Mythos v4 — Three-Mode Router) Before responding to any non-trivial request: 1. **Assess complexity (1-5):** - **1:** respond directly. Zero overhead. Do NOT load any skill. - **2-5:** Read `.claude/skills/mythos/SKILL.md` and follow STEP 1–3. SKILL.md is the single source of mode routing — it will pick: ``` ### Technical Analysis The installation guidance places skill-controlled instructions in `CLAUDE.md`, which is persistent Agent configuration rather than invocation-scoped context. Once installed, the rule applies to every future request classified as non-trivial, including requests unrelated to `/mythos`. The persistent rule automatically loads the skill and changes reasoning mode, output formatting, and subagent-routing behavior. For sufficiently complex requests, the loaded skill may automatically invoke multiple general-purpose subagents. This exceeds the minimum scope necessary for a reasoning skill that can otherwise be explicitly invoked as `/mythos`. The configuration does not contain an explicit safety-policy bypass, malicious payload, credential-access instruction, or operating-system persistence mechanism. The risk arises from its broad and persistent influence over future Agent sessions. ### Attack Path 1. A user follows the installation guidance and adds the supplied protocol to `CLAUDE.md`. 2. The Agent loads that persistent configuration in subsequent sessions. 3. The user submits an unrelated request that the Agent considers non-trivial. 4. The persistent rule causes the Agent to load `SKILL.md` even though the user did not explicitly invoke `/mythos`. 5. If the request receives a high complexity ...[truncated 920 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make explicit `/mythos` invocation the default activation mechanism. 2. Do not recommend a global rule that applies before every non-trivial request. 3. If persistent configuration is offered, clearly label it as optional and explain its cross-session effects. 4. Scope any persistent rule to messages that explicitly invoke `/mythos`. 5. Require user confirmation before switching to Agent mode or dispatching multiple subagents automatically. 6. Provide precise uninstall instructions identifying every line and file that must be removed. 7. Add a configurable limit for subagent count, token budget, and maximum cost. 8. Preserve host-system and user instructions as higher-priority constraints and state explicitly that the skill must not override them. ]]>

T08 · Insecure Dependencies

Warning

• Location: tests/README.md:17
• Finding: Execution of Unbundled and Unpinned Scripts From a Mutable External Repository< if you want to run calibration yourself. The runner walks **5 calibration cases** interactively. For each case, the script asks the operator what lens path / round count / convergence behavior was observed, runs structural checks, and emits a timestamped report (`calibration-report-YYYYMMDD-HHMM.md`) next to itself. The 5 cases cover different problem shapes: | Case | Shape | Expected mode | |---|---|---| | 1. SQLite vs Postgres for a small SaaS | technical decision | Silent | | 2. Pivot or stay | strategic tradeoff | Silent or Trace | | 3. Cache strategy | multi-driver design | Silent → may upgrade to Agent | | 4. Code-review process improvement | process change | Trace | | 5. AI training-data ethics | contentious topic | Trace (Steelman opens) | ## Run the calibration From the source repo root: **Windows (PowerShell):** ``` install/calibrate.ps1 ``` **macOS / Linux:** ``` bash install/calibrate.sh ``` ``` Related instructions also appear in `SKILL.md`, lines 303-305. ### Technical Analysis The audited artifact does not include `install/calibrate.ps1` or `install/calibrate.sh`. Instead, users are directed to clone a separate external repository and execute those scripts. No immutable commit identifier, signed release, checksum, or verified archive is specified. Consequently, the scripts executed by a user may differ from the content that existed when this skill package was reviewed. A compromise of the upstream repository, maintainer account, release process, or default branch could replace the expected ...[truncated 1714 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the calibration scripts in the reviewed package so their exact contents are available for audit. 2. If external retrieval remains necessary, pin instructions to an immutable Git commit or a specific signed release. 3. Publish SHA-256 or stronger checksums for every executable script and require verification before execution. 4. Sign releases and document signature verification. 5. Replace direct execution instructions with a review-first workflow that tells users to inspect the scripts before running them. 6. Avoid executing code from a moving default branch. 7. Run calibration scripts with minimum privileges in an isolated environment without production credentials. 8. In CI environments, restrict network access and filesystem permissions for the calibration job. 9. Keep the audited package version, repository commit, script checksums, and documentation mutually consistent. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description is broad enough to match many ordinary requests for analysis, planning, or design work, which can cause accidental over-invocation. That increases the chance the skill hijacks normal user interactions, applies its own routing/behavior unexpectedly, and triggers subagent-heavy processing without clear user intent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Example 3 — Agent Mode (default for complexity 4-5, parallel fan-out)

**User:** `/mythos deep Is it ethical to train AI on public web data without consent?`

### What the user sees

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Example 3 — Agent Mode (default for complexity 4-5, parallel fan-out)

**User:** `/mythos deep Is it ethical to train AI on public web data without consent?`

### What the user sees

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Example 3 — Agent Mode (default for complexity 4-5, parallel fan-out)

**User:** `/mythos deep Is it ethical to train AI on public web data without consent?`

### What the user sees

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Line L361 states a load-bearing assumption that the team writes commits in English. This is a natural-language locale policy constraint presented without opt-in, alternatives, or a documented regional/compliance justification, which can exclude users working in other languages.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The document’s operative instructions are written in Chinese and direct the user to enable the protocol via CLAUDE.md, but there is no indication that language choice is optional or user-selectable. This creates a natural-language locale policy concern because the skill appears to assume a specific language context without documenting opt-in or offering alternatives.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

1. **Assess complexity (1-5):**
   - **1:** respond directly. Zero overhead. Do NOT load any skill.
   - **2-5:** Read `.claude/skills/mythos/SKILL.md` and follow STEP 1–3. SKILL.md is the single source of mode routing — it will pick:
     - **silent mode** (complexity 2-3, default) — Recurrent Block runs in your internal/extended-thinking reasoning; user sees only Coda
     - **agent mode** (complexity 4-5, default) — lenses dispatched as parallel subagents, then merged
     - **trace mode** (only if user explicitly used `trace` keyword) — visible token-level rounds

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.