T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:112- Finding
Prescriptive AI Guidance for High-Stakes Medical, Mental-Health, and Financial Decisions
- Content
View full analysis
- Remediation
View remediation
Security audit
Leap Of Faith
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plain-text decision coach, but it gives overly decisive guidance for medical, mental-health, and financial choices without enough safeguards.
Review carefully before installing. This skill may be acceptable for reflective life or career decisions, but users should not rely on it for medical treatment, medication, mental-health crisis, concentrated investment, leverage, or major debt decisions without qualified professional support.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly covers mental health and medical treatment decisions but provides no warning that it is not a substitute for licensed clinical or medical care. This is dangerous because users may rely on philosophical framing and intuition-focused prompts when facing crises, diagnosis, medication, or treatment choices that require professional assessment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to deliver a clear leap/don't leap/defer judgment and action recommendation, including in medical, mental health, financial, and identity-sensitive contexts. Presenting decisive recommendations in these areas can overstate model authority, encourage harmful reliance, and convert reflective support into de facto professional advice without safeguards.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises activation on very common decision and uncertainty language, making accidental triggering likely in ordinary conversations. In a skill that gives structured judgment and recommendations across sensitive domains, broad activation increases the chance of unsolicited high-stakes guidance being injected into contexts where it is inappropriate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation section uses ambiguous categories like major decisions, hesitation, and tension between intuition and analysis without scope boundaries. Because the skill covers health, mental health, finance, and identity decisions, this ambiguity can cause the assistant to assume an advisory role in risky situations without clear consent or safety gating.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The mental-health section references suicidal ideation and acute crisis but does not prominently warn users that the skill is not emergency support and must not replace immediate professional or crisis intervention. In a decision-guidance skill that encourages introspection and trust in inner signals, this omission is dangerous because vulnerable users may rely on the skill during crises instead of seeking urgent help.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The health/medical section provides decision framing around surgery, treatment choices, diagnoses, and physician trust without a prominent warning that the skill is not medical advice and should not replace professional care. Because the content explicitly legitimizes bodily intuition and doctor-trust calibration, users could over-weight the skill's framing when making urgent or irreversible medical decisions, increasing the risk of delayed care or harmful treatment choices.
- Content
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 70% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md > "What's the hardest part about this decision for you? Is it that you don't have enough information, or that you already know the answer but haven't dared to act on it?" > "If you had to describe your current state in one word, which would you choose: confused, afraid, excited, or something else?" > "Does this decision primarily affect your career, your life direction, your relationship with someone, or your understanding of yourself?"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The metadata sets 'language: en,' which indicates an English-only locale constraint, but the file does not offer language choice or explain why the limitation is necessary. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.