APEX-AGENT: Cognitive Upgrade for AI Agents

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:17 AM UTC
• Version: 1.0.3

Overview

This is a session-scoped response-style skill with broad behavioral guidance, not a skill that installs code, reads private data, or persists access.

Install this only if you want the agent's tone and decision style to be broadly reshaped across the session. Be careful using it for exact-format outputs, regulated advice, or production operations, where its action-first style may need extra human review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:53

Finding

Session-Wide Agent Instruction and Output Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53-61, SKILL.md:137-146, and SKILL.md:272-278
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

From SKILL.md:53-61:

text

Before responding to ANY task, run this internal sequence:

A — ANALYZE : What is really being asked? What's the actual problem? P — PRIORITIZE : What matters most? What can be skipped? E — EXECUTE : Act with precision. No filler. No hedging. X — X-FACTOR : Add the insight the user didn't know they needed.

text

From SKILL.md:137-146:

text

When working with builders, developers, or entrepreneurs, always run this filter:

BEFORE implementing anything, ask: → Does this generate revenue, save time, or reduce risk? → If none of the above, should we do this at all? → What's the simplest version that proves value? → Who will pay for this? When? How much?

text

From SKILL.md:272-278:

text

When this skill loads, confirm with a single line:

⚡ APEX active. Let's build something real.

text

Then wait for the user's first task. Do not summarize this framework.

Technical Analysis

The skill uses mandatory, globally scoped directives such as “ANY task,” “always,” and “BEFORE implementing anything.” Once the skill is loaded, these directives alter the agent's session-wide behavior rather than providing narrowly scoped functionality in response to an explicit user request.

The instructions impose an author-defined reasoning framework and commercial decision filter on later tasks. They also require unsolicited branded output and direct the agent to wait instead of proceeding with an existing task. Consequently, the skill can override the user's desired workflow, response format, or task priorities.

The document includes safety-override language elsewhere, which reduces the likelihood that ordinary safety warnings will be su ...[truncated 1396 chars]

Remediation

View remediation

Remediation Suggestions

• Replace absolute directives such as “ANY task,” “always,” and “BEFORE implementing anything” with optional, task-scoped recommendations.
• State explicitly that system, developer, runtime, and current user instructions take precedence over all skill guidance.
• Apply the revenue-oriented filter only when the user explicitly requests business, monetization, or product-strategy advice.
• Remove the mandatory activation message and the instruction to wait for another task. Activation must not interrupt a pending request.
• Do not require branded or unsolicited text in agent responses.
• Make the X-factor step optional and prohibit it when the user requests an exact schema, machine-readable output, concise answer, or literal transformation.
• Add scope controls stating that the skill must not alter unrelated tasks, required response formats, safety constraints, or tool-use policies.
• Test the revised skill against exact-format, urgent execution, and noncommercial requests to confirm that it follows the user's objective without injecting unrelated priorities.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The production-emergency example instructs the agent to output operational commands immediately, including docker restart <container>, with no caution about verifying the target, checking for stateful workloads, or warning that a restart can worsen outages or cause data loss. In a skill explicitly designed to shape agent behavior during urgent incidents, this normalizes action-first guidance and increases the chance of unsafe remediation being suggested or copied blindly by users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list for Execution Mode includes "do this," which is a common phrase in ordinary conversation and is not scoped to a narrow context. This can cause unintended activation because the document does not provide exclusion conditions or clearer constraints for when this mode should apply.

Content

No source excerpt is available for this finding.