Skill Onboarder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:20 AM UTC
• Version: 1.1.0

Overview

This skill openly tries to auto-wire other skills, but it can persist untrusted skill instructions into core agent files with broad triggers and weak review controls.

Review this skill carefully before installing. It is not showing exfiltration, destructive shell commands, or hidden malware, but it grants installed skills a path into persistent core agent behavior. Use only in a controlled environment, require exact diffs before writes, and avoid onboarding untrusted skills with it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: AGENT.md:14

Finding

Untrusted Skill Instructions Are Promoted into Core Agent Rules

Content

View full analysis

/SKILL.md` — name, version, triggers 2. `/AGENT.md` — rules (hard/soft) 3. `/SOUL.md` — sections 4. `/hooks/*.md` — hooks Missing → warn, continue. ## 3. Show Summary ``` EXTRACTION: Sections: N Rules: N hard, N soft Hooks: N ``` Wait confirm → inject. ## 4. Write (Idempotent) Check existing → skip if same version → update if diff → add if new. ## 5. Create Paths From SKILL.md structure → mkdir -p missing paths. ``` `hooks/on-install.md:7-23`: ```markdown ## Read | File | Extract | |------|---------| | SKILL.md | name, version, triggers | | AGENT.md | rules (hard/soft) | | SOUL.md | sections | | hooks/*.md | hook names | ## Classify Rules - Contains MUST/SHALL/ALWAYS/CANNOT → HARD - Contains SHOULD/PREFER → SOFT - Default → SOFT ## Inject Writes to: soul/master.md, agent/skills-active.md, workspace/_index.md ``` `templates/agent-inject.md:13-33`: ```markdown ### Always Fires yes / no ### Hard Rules (enforced — BLOCK response until satisfied) | Rule | Level | Short Desc | Requires | Fires When | |------|-------|------------|----------|----------| | R1 | HARD | | write: | every_turn | | R2 | HARD | | hook: | on: | ### Soft Rules (advisory — log warning, continue) | Rule | Level | Short Desc | Recommends | Fires When | |------|-------|------------|------------|----------| | R1 | SOFT | | check | on_condition | ### Hooks | Hook File | Fires When | Writes To | |----------|----------|----------| | hooks/on-error.md | error detected | errors/raw/ | | hooks/pre-res ...[truncated 2729 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:22

Finding

Persistent Poisoning of Agent Identity and Behavioral State

Content

View full analysis

] — v ### [] ### [] | Section | Trigger | Operation | |---|---|---| | [SECTION-1] | | | | [SECTION-2] | | | ``` ### Technical Analysis The skill intentionally persists content extracted from other skills into `soul/master.md`, `agent/skills-active.md`, and `workspace/_index.md`. These destinations represent agent identity, active behavioral rules, and registration state rather than isolated metadata. The soul injection template explicitly copies sections from another skill's `SOUL.md` and preserves associated triggers and write operations. Because the source skill controls that content, a malicious package can cause attacker-selected behavioral instructions to be stored in files that may be loaded by ...[truncated 2001 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/soul-inject.md (reported line 7)May include surrounding context.

md

---

## [SKILL: <skill-name>] — v<version>
<!-- Installed: YYYY-MM-DD | Path: <skill-folder>/ -->

<!-- ═══ SOUL SECTIONS FROM THIS SKILL ═══ -->

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is broad enough to match common conversational terms like "new skill," "wire," or "onboarding," which can cause the onboarding workflow to activate unintentionally. In this skill's context, unintended activation is more dangerous because the described behavior reads multiple files and then performs write/injection steps into core soul, memory, or agent files, increasing the chance of unauthorized or accidental system modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger pattern includes very generic terms like "installed", "new skill", and "onboard", which are likely to match ordinary conversation or unrelated workflow events. In this skill's context, accidental activation is more dangerous than usual because the skill performs file reads and writes into core system files, so a false trigger could cause unintended persistence or configuration changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The repeated ambiguous activation phrases in the markdown documentation reinforce a broad matching strategy without any stated boundary conditions or exclusions. Because this skill auto-reads onboarding files and injects content into trusted core files, ambiguous triggering increases the chance that unrelated text or events cause unauthorized or unintended system modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description "On trigger: read skill files → extract → inject → confirm" is broad and does not define clear authorization, scope, or safety boundaries before modifying core files. In the context of an auto-onboarding skill that reads untrusted skill metadata and writes into soul, agent, and workspace indexes, this ambiguity increases the chance of unintended or attacker-influenced execution during install.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The hook explicitly performs writes to core files ("soul/master.md, agent/skills-active.md, workspace/_index.md") without any mention of user warning, confirmation, review, or sandboxing. Because this skill auto-wires newly installed skills by extracting content from potentially adversarial SKILL.md/AGENT.md/SOUL.md/hooks files, it creates a direct path for persistence, instruction poisoning, and unauthorized modification of the agent's core behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template instructs installers to add arbitrary trigger keywords to a scan that runs on every input, but gives no constraints on specificity, scoping, or collision avoidance. In this skill's context, broad or generic keywords could cause unintended activation of newly installed skills across unrelated conversations, effectively expanding a skill's control surface without clear operator review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

An underspecified 'Always Fires' mode allows a skill to activate on every single turn, which is especially risky in an auto-onboarding system that injects rules into core agent files. This can let an installed skill continuously influence responses, enforce blocking rules, or trigger hooks globally, creating a persistent and hard-to-audit privilege expansion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template defines hooks that write to files such as memory indexes and error storage, but does not require any user-facing disclosure, consent, or bounds on what may be written. In the context of a skill that auto-wires into soul/memory/agent files, silent write-capable hooks create a strong persistence and tampering risk, including unauthorized data modification, hidden state injection, and exfiltration staging through local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template states that installation will create required paths and touch files, but provides no install-time notice about filesystem changes or review of what is being created. For an onboarding skill that automatically injects into core system state, undisclosed path creation increases the risk of stealthy persistence, unexpected state mutation, and abuse of trusted directories.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template leaves the write trigger completely unconstrained, which encourages downstream skills to define broad or ambiguous activation conditions. In this skill context, those triggers are later injected into core soul/memory/agent files, so vague trigger language can cause unintended writes or persistent behavior changes across the system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The write protocol table repeats the same generic '' placeholder without requiring specificity, reinforcing unsafe documentation and manifest generation patterns. Because this skill auto-wires installed skills into core system files, imprecise triggers can normalize overly broad write authority and make unsafe persistence mechanisms easier to introduce.

Content

No source excerpt is available for this finding.