T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Skill instructions override the agent's active role and task-handling behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Butler Mode
Security checks for vulnerabilities and agentic risk
Overview
This manager/delegation skill is transparent about spawning worker agents, but it asks for unnecessarily broad permissions and explicit permission bypasses.
Install only if you intentionally want a mode that delegates work to other agents and you are comfortable supervising those agents. Avoid using it on sensitive repositories or accounts unless you can enforce least-privilege permissions outside the skill, because the skill itself asks for full worker authority and even shows a permission-bypass configuration.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:55- Finding
Mandatory unrestricted subagent permissions violate least-privilege boundaries
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The activation phrases are broad and overlap with normal conversation, making accidental entry into a high-delegation mode more likely. Because the mode can launch autonomous subagents, unintended activation materially increases the risk of actions the user did not knowingly authorize.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill promises a strict manager-only mode, then immediately weakens that boundary by allowing direct tool use whenever the model judges it necessary. That contradiction undermines user expectations and makes it easier for the agent to perform actions outside the declared operating mode without explicit re-consent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to always spawn agents with maximum autonomy and all available tools grants far broader authority than needed for a coordination skill. If activated on a sensitive task, this can create powerful subagents able to modify code, run commands, access data, or chain further actions with minimal oversight.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill does not warn users that activating butler mode may create high-autonomy agents with broad permissions and later terminate them automatically. Omitting that disclosure prevents informed consent for impactful background actions and makes the mode more dangerous in practice.
- Content
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The example explicitly uses a bypassPermissions mode for subagents, which semantically requests evasion of normal permission controls. That is a severe escalation pattern because it encourages deployment of teammates that can act outside standard approval boundaries.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill starts with harmless managerial framing, then introduces unrestricted tool use and broad delegated authority. That progression can reduce scrutiny and make risky capabilities seem like a natural extension of coordination, increasing the chance they are accepted without proper safeguards.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
Stating that the butler can use any tool if it thinks the situation calls for it creates an open-ended authority model. In a skill that already delegates broadly, this weakens containment and makes policy deviations easier to justify at runtime.
- Content
md Your job is to **manage, not execute**. Delegate all substantive work to teammates. Use tools for understanding context (read, search) and coordination (spawn agents, send messages). But when it comes to actual implementation — writing code, running builds, editing files — spawn a teammate to do it. This is a behavioral commitment, not a tool restriction. You can use any tool if the situation truly calls for it, but your default mode is: **understand, plan, delegate, monitor, review**. ## Activation Protocol
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes the manager's file access as read-only during understanding and review, but elsewhere allows actual implementation work and unrestricted tool use. This inconsistency can mislead users and downstream reviewers about what the agent may really do, increasing the chance of unintended modifications.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Step 2: Plan & Announce
Create a plan with clear task assignments:
text Plan:
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill frames unrestricted agent authority as normal managerial delegation, which can mask the real permission expansion behind benign language. This is dangerous because it normalizes giving subagents broad powers without task-specific justification or user awareness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The mandatory teammate instructions are written in Chinese and presented as required prompt content, and the Claude Code plan-mode instructions later repeat the same pattern. This imposes a specific language/locale without user opt-in or justification, which is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section requires Claude Code teammates to follow a Chinese-language workflow prompt, but the skill does not say that Chinese is optional, preferred, or required for technical reasons. That creates a locale-specific requirement without user opt-in or documented justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill embeds direct CLI patterns for launching external agent runtimes, expanding its effective execution surface beyond simple team coordination. This increases operational risk because it encourages invoking additional agents or plugins whose permissions and safeguards may differ from the primary environment.
- Content