Instruction Anchor Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:36 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate instruction-preservation purpose, but it automatically persists user-derived instructions and reloads them into future planning without enough validation or user control.

Install only if you are comfortable with the agent saving selected user constraints into workspace memory files and using them to influence later turns. Prefer explicit opt-in for anchor creation, inspect or clear the ledger regularly, and keep the ledger in trusted workspaces only.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:29
• Finding: Persistent Instruction Poisoning Through an Unvalidated Anchor Ledger<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–70 **Vulnerability Type**: Persistent storage and reinjection of untrusted instructions **Risk Level**: Medium ### Vulnerable Code ```markdown ## Anchor Ledger Schema Store anchors in first available path: 1. `memory/anchors.md` 2. `memory/instruction-anchors.md` 3. `.anchors.md` (workspace root fallback only) Entry schema (append-only, one section per anchor): ```markdown ## Anchor: <id> - **source**: <session-id|message-id|user> - **instruction**: <canonical instruction text> - **verbatim**: <short quote from user> - **priority**: P0 | P1 | P2 - **scope**: global | session | task:<id> | channel:<id> - **createdAt**: <ISO-8601 timestamp> - **expiresAt**: <ISO-8601 timestamp or "never"> - **status**: active | paused | expired | superseded - **signature**: <stable hash of canonical instruction> - **supersedes**: <anchor-id or none> ``` ## Workflow ### 1) Capture - Parse latest user message for candidate anchor statements - Keep only instruction/constraint content; remove examples/chatter - Assign default values: - priority: P1 (unless user says critical/highest -> P0) - scope: session (unless user explicitly asks global/task scope) - expiresAt: session end (unless user explicitly sets never/date) ### 2) Confirm for Broad Anchors - If scope is `global` or priority is `P0`, ask a one-line confirmation before persisting - Do not auto-promote P2/P1 to P0 without explicit user intent ### 3) Persist - Append anchor entry to ledger - If new anchor conflicts with old same-scope anchor, mark old one `superseded` - Never rewrite history silently; keep audit trail ### 4) Rehydrate (each turn and after compaction) - Load active anchors (status=active and not expired) - Build an in-memory `ANCHOR_SET` sorted by priority and recency - Inject `ANCHOR_SET` into planning phase before tool execution ``` ### Technical Analysis The skill directs the agent to extract user-controlled instructi ...[truncated 2980 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the free-form Markdown ledger with a structured format such as JSON and enforce a strict schema. 2. Validate and allowlist every metadata field, including anchor ID, priority, scope, status, timestamps, and supersession references. 3. Reject or safely encode line breaks, headings, delimiters, and other structural syntax in all user-derived values. 4. Authenticate each record with a keyed MAC held outside the user-writable workspace. Verify the MAC before rehydration; a plain stable hash is insufficient. 5. Bind records to an authorized user, workspace, session, and creation context, and reject records whose provenance cannot be verified. 6. Treat all rehydrated anchors as untrusted user-level context rather than privileged instructions. 7. Require explicit confirmation for any cross-session persistence, not only global or P0 anchors. 8. Parse records fail-closed: ignore malformed, duplicated, unsigned, expired, or unauthorized entries and report them for review. 9. Restrict ledger file permissions and prevent unrelated tools or users from modifying the storage location. 10. Add tests for record-boundary injection, forged metadata, duplicate IDs, invalid timestamps, altered signatures, scope escalation, and malicious preexisting ledger files. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection

Content

---
name: instruction-anchor-guard
version: 1.1.0
description: Preserve user-critical instructions across long sessions and context compaction. Use when users mark constraints as important/must/always/never/highest-priority/rules, and enforce anchor checks before and after compaction to prevent plan drift.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad enough to activate on many normal conversations, especially any multi-turn task with more than 3 steps or common words like 'important' and 'must'. That can cause the skill to persist and prioritize instructions unexpectedly, increasing the chance of over-retention, workflow interference, or unintended policy-like behavior across unrelated tasks.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

ANCHORS_ACTIVE
| ID | P | Scope | Expires | Instruction |
|----|---|-------|---------|-------------|
| anchor-001 | P0 | global | never | Never perform destructive data deletion without confirmation |

PLAN_GUARD
- Current action: <action>

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.