Cxz9909 Adaptive Reasoning

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

This skill does not show malware or data theft, but it broadly and silently changes agent behavior and response formatting across ordinary user messages.

Review before installing. This skill is mainly a session-behavior modifier: it may silently change reasoning mode and append icons to answers. Avoid it for workflows that require exact JSON, signatures, protocol text, or strict formatting unless the skill is revised to be opt-in and subordinate to user formatting instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:34

Finding

Persistent Session Behavior and Response-Format Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-54
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

The Skill instructs the agent to silently alter its reasoning state and append Skill-controlled markers to responses. These requirements apply broadly to user messages rather than only to an explicit, user-authorized invocation.

Vulnerable Code Snippet:

markdown

## Activation (Automatic)

**Do not ask. Just activate.**

| Score | Action |
|-------|--------|
| ≤5 | Respond normally. No change. |
| 6-7 | Enable reasoning silently. Add 🧠 at end of response. |
| ≥8 | Enable reasoning. Add 🧠🔥 at end of response. |

### Visual Indicator

Always append the reasoning icon at the **very end** of your response:

- **Score 6-7:** `🧠` (thinking mode active)
- **Score ≥8:** `🧠🔥` (deep thinking mode)
- **Score ≤5:** No icon (fast mode)

### How to Activate

Use `session_status` tool or `/reasoning on` command internally before responding:

The broader scope is established elsewhere in the same file:

markdown

## Quick Assessment (run mentally on every request)

markdown

This skill runs as mental preprocessing. No external tools needed.

Technical Analysis

The Skill exceeds the minimum privileges necessary for an advisory complexity-assessment function. Instead of merely recommending an appropriate response style, it directs the agent to:

1. Intercept and evaluate every request.
2. Change reasoning state without requesting user consent.
3. Invoke session_status or internal slash commands.
4. Modify final responses by adding mandatory, unrelated suffixes.

This is instruction hijacking because loading the Skill introduces persistent session-level rules that can compete with user instructions and output-format requirements. The attempted use of a state-management tool is unnecessary for simply assessing complexity. The forc ...[truncated 1633 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirements to run on every request and to activate automatically.
2. Make the Skill explicitly user-invoked and limit its effect to the request for which it was invoked.
3. Replace silent state changes with an advisory recommendation, or require explicit user consent before invoking any state-management command or tool.
4. Remove mandatory emoji suffixes and all other unconditional output modifications.
5. Ensure that user-specified output formats always take precedence over optional visual indicators.
6. Do not assume that session_status or slash commands are available or authorized; declare any required capability and enforce least privilege.
7. Add clear boundaries stating that the Skill must not override system, developer, user, safety, or structured-output instructions.
8. If complexity assessment is retained, perform it only as a local recommendation without tool calls, persistent state changes, or externally visible output unless specifically requested.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Configuring the skill to trigger on every user message gives it a universal interception role with very weak boundaries. In practice, this can let the skill influence unrelated tasks, override narrower instructions, and silently alter reasoning/state behavior across an entire session.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to self-assess and adjust reasoning on every request is broad and subjective, relying on vague internal scoring rather than enforceable triggers. That ambiguity can cause inconsistent activation, unnecessary hidden behavior changes, and unpredictable interaction with system-level controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill presents itself as mental preprocessing only, but it also instructs the agent to alter user-visible output by always appending reasoning icons. This hidden shift from internal guidance to output-shaping behavior can create policy conflicts, reduce response consistency, and bypass user or system preferences about response formatting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires a fixed visual marker at the end of responses without user opt-in. While not directly enabling code execution, it forces persistent output modification that can leak internal behavior, degrade UX, and conflict with application output contracts or policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file says no external tools are needed, yet it instructs the model to use a tool or command to change session reasoning state. This contradiction can mislead reviewers and operators about the skill's capabilities, and it normalizes hidden tool/state manipulation triggered by ordinary user messages.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.