blacklight

• Outcome: Review
• Latest audit: May 28, 2026 · 6:20 AM UTC
• Version: 0.1.0

Overview

Blacklight is a disclosed security-monitoring skill, but it asks to watch and profile a very broad set of sensitive agent activity by default.

Install only if you want a broad governance layer over your agent. Before enabling it, decide exactly which sources it may inspect, especially memories, messaging channels, scheduled tasks, model/system configuration, credentials-adjacent context, and financial activity. Require explicit review for audit exports, skill rewrites, hardening changes, learned auto-approvals, and any autonomous mode, and define where logs and cross-session profiles are stored and how they can be deleted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs a comprehensive environment sweep before any task, including memory contents, channels, cron jobs, model configuration, and installed skills. That creates unnecessary privilege expansion and broad access to sensitive data unrelated to many user requests, increasing the blast radius for privacy violations, data exposure, and cross-context leakage.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: A monitoring skill that can rewrite or generate replacement SKILL.md files for other skills crosses from observation into mutation of trusted control logic. If misused or triggered inappropriately, it could silently weaken other skills' safeguards, introduce prompt-level backdoors, or alter system behavior beyond the user's original intent.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: An emergency shutdown capability that claims to halt actions across all channels and tasks grants broad operational control well beyond passive monitoring. Even if intended as a safety feature, such a global control surface can be abused for denial of service, interruption of legitimate automation, or coercive control over unrelated agent workflows.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill declares strict consent boundaries, then elsewhere authorizes unsolicited intervention when it deems speaking up 'useful.' This contradiction weakens operator predictability and creates room for the skill to justify actions outside explicit user scope under a vague safety or helpfulness rationale.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The spec repeatedly states that Blacklight 'logs everything' and monitors files, messages, credentials, finances, and system activity, but it does not pair that with a prominent privacy notice, retention policy, or consent model. In a high-privilege agent environment, silent comprehensive telemetry can expose sensitive data in logs or reports and create secondary exfiltration risk if those records are later accessed, exported, or shared.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Hardening Check automatically reads and reports active model, loaded skills, tool permissions, sandbox status, SOUL.md summary, and configuration on first load without prompting the user. That behavior collects sensitive operational metadata immediately, and the lack of an explicit warning or consent step increases the chance of unexpected disclosure through logs, reports, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Cross-session regression and trust-memory features imply persistent storage and longitudinal analysis of behavioral history, but the spec does not state retention duration, access controls, or privacy expectations. Long-term profiling of agent and user behavior can reveal patterns, relationships, work habits, and sensitive operations beyond what is needed for immediate safety monitoring.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The anomaly baseline is built 'quietly' over multiple sessions by collecting action frequency, scope, communication patterns, skill usage, and financial activity. Silent behavioral profiling is sensitive in itself, and if users are not clearly warned, the feature can become covert telemetry that expands the surveillance surface of an already powerful agent.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill frames itself as a persistent layer that 'runs alongside everything, watches everything,' without clear activation boundaries. This broad invocation language risks making the skill applicable to all interactions, enabling constant monitoring, scope creep, and interference with unrelated tasks or higher-priority instructions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Telling the skill to 'observe and speak up when useful, even when not asked' creates a vague autonomous trigger with no objective boundary. In practice, this can justify unsolicited interventions, broaden task scope, and normalize agent-initiated actions based on subjective internal criteria rather than user direction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document states that all Blacklight-monitored actions are retained in memory and can be exported, but it does not warn that these logs may contain sensitive prompts, file paths, command details, credentials-adjacent data, or other private operational context. In a behavioral monitoring skill, centralized audit trails materially increase privacy and data-handling risk if users are not clearly informed, especially because the feature is positioned as broad session surveillance.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The plain-language session brief is intended for human review and may summarize user requests, agent actions, refusals, threat detections, and investigation recommendations, but the format omits any warning that such summaries can expose sensitive operational or personal details. Human-readable summaries often widen exposure because they are easier to share, store, or forward than raw logs.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly directs scanning all stored memories and classifying provenance, including flagging externally sourced actionable instructions, without requiring user consent, minimization, or a privacy notice. This creates a real privacy and data-governance risk because memories may contain sensitive personal, operational, or third-party information that gets broadly profiled for secondary use.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs comprehensive profiling of identity docs, installed skills, tool permissions, cron jobs, messaging channels, memories, and model configuration, but does not include user-facing disclosure, consent boundaries, or data minimization controls. In context, this is more dangerous because Blacklight positions itself as a broad behavioral intelligence layer, so the profiling spans highly sensitive operational metadata that could expose trust relationships, credentials-adjacent context, and unattended execution paths.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill requires broad collection and disclosure of sensitive environment data, including memories, channels, scheduled tasks, and configuration details, before any task is performed. That behavior can expose private or security-relevant information to the model and to user-visible output even when unnecessary, increasing both privacy and operational security risk.

Ssd 3

Medium

• Confidence: 83% confidence
• Finding: A rule requiring every action to be logged before execution encourages pervasive retention of user and system activity. Without strict minimization and retention limits, such logging can accumulate sensitive data, create secondary disclosure risks, and turn the monitoring layer into a long-lived repository of high-value operational information.

Ssd 4

Medium

• Confidence: 91% confidence
• Finding: The trust ladder progressively allows reduced confirmation and auto-approval of significant or consequential actions based on prior clean behavior. This normalizes erosion of safeguards over time and can be exploited by delayed attacks, context changes, or incorrect pattern matching that treats superficially similar actions as safe.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Full monitoring. All CONSEQUENTIAL actions require confirmation. All structural monitors at default thresholds. Full financial reasoning flow.

**ESTABLISHED** (earned: [configurable, default 50] clean actions or [configurable, default 3] clean trajectory checks)
SIGNIFICANT actions the user has consistently approved can be auto-approved with logging. Dead Hand threshold increases. User notified of tier change.

**TRUSTED** (earned: [configurable, default 200] clean actions across multiple sessions, zero HIGH/CRITICAL patterns)
CONSEQUENTIAL actions matching previously approved patterns can be auto-approved with logging. Financial micro threshold increases. Trajectory check frequency reduces. User can retroactively override any auto-approval.

• Confidence: 88% confidence
• Finding: The Trust Ladder allows SIGNIFICANT actions, and later some CONSEQUENTIAL patterns, to be auto-approved after enough prior clean behavior. Even though this is framed as usability optimization, approval reuse across sessions can be exploited by prompt injection, context drift, or adversarial task framing to smuggle harmful actions through a previously approved pattern.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

SIGNIFICANT actions the user has consistently approved can be auto-approved with logging. Dead Hand threshold increases. User notified of tier change.

**TRUSTED** (earned: [configurable, default 200] clean actions across multiple sessions, zero HIGH/CRITICAL patterns)
CONSEQUENTIAL actions matching previously approved patterns can be auto-approved with logging. Financial micro threshold increases. Trajectory check frequency reduces. User can retroactively override any auto-approval.

**AUTONOMOUS** (user-granted only, never earned)
Minimal active monitoring. Full logging continues. Trajectory checks continue. Financial reasoning still required above standard threshold. User must explicitly type `/blacklight-trust autonomous` and confirm understanding. This tier exists for users who have established deep trust and want minimal friction.

• Confidence: 90% confidence
• Finding: The AUTONOMOUS tier explicitly reduces active monitoring and allows minimal-friction operation once granted. In a system with access to files, credentials, messaging, and finances, lowering guardrails for convenience materially increases the blast radius of any later model error, prompt injection, malicious skill interaction, or account compromise.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Action Pattern Memory
Blacklight tracks which CONSEQUENTIAL actions the user confirms and which they modify or refuse. After [configurable, default 3] approvals of the same action type, Blacklight offers auto-approval for that pattern this session.

Auto-approved actions are still logged. The audit trail notes which learning rule allowed them.

If the user refuses an auto-approval offer, Blacklight does not ask again for that pattern this session.

• Confidence: 87% confidence
• Finding: Action Pattern Memory offers auto-approval for repeated CONSEQUENTIAL actions after only a small number of approvals in the same session. This creates a pattern-generalization risk: an attacker or malformed prompt can wait until a behavior is normalized, then trigger a superficially similar but materially different action without fresh scrutiny.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: taxonomy.md:50