DCL Semantic Drift Guard — Hallucination & Context Drift Detector

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 1.0.2

Overview

This skill is a mostly local semantic fact-checking guide with clearly disclosed optional network modes, though users should only use trusted RAG endpoints.

Install only if you are comfortable with a local-by-default verification skill that has optional external modes. Use context mode for confidential or regulated text. If using kb_query, provide only trusted HTTPS knowledge-base endpoints you control, and avoid letting untrusted users supply arbitrary endpoint URLs. Use the optional paid MCP pre-check only after confirming that sending llm_output text and writing audit metadata externally is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:140

Finding

Arbitrary RAG Endpoint Access Without Destination Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 140-143
Vulnerability Type: Server-Side Request Forgery (SSRF)-style arbitrary endpoint access
Risk Level: Medium

Vulnerable Code Snippet

markdown

**If `source_mode = "kb_query"`:**
⚠️ This sends `kb_query` to `kb_endpoint` over the network. Confirm with the user before using
this mode if the query or surrounding context could reveal anything confidential. Query the
`kb_endpoint` with `kb_query`. Retrieve top-k relevant chunks. Treat the union of retrieved
chunks as the authoritative source. If the endpoint is unreachable, return `status: "error"`
with `reason: "kb_unavailable"`.

Technical Analysis

The skill directs a network-capable agent to query a caller-supplied kb_endpoint, but it does not require validation of the endpoint's scheme, hostname, resolved IP address, port, or redirect destinations. The documented confirmation requirement concerns disclosure of confidential query data; it does not address access to unsafe destinations.

If the endpoint value can be influenced by an untrusted caller, the instruction creates an SSRF-style primitive. An attacker could provide a URL resolving to a loopback, private-network, link-local, or cloud metadata address. The agent may then access a service that is reachable from its execution environment but not directly reachable by the attacker.

The instruction also says to treat retrieved chunks as authoritative. Consequently, data returned by an attacker-controlled or internal endpoint could affect the semantic-drift verdict and undermine the integrity of the verification process.

Attack Path

1. An attacker invokes the skill in kb_query mode.
2. The attacker supplies a crafted kb_endpoint targeting an internal service, loopback interface, link-local address, cloud metadata endpoint, or a public URL that redirects to such a destination.
3. A network-capable agent follows the workfl ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

• Do not accept unrestricted endpoint URLs at invocation time. Use administrator-configured, trusted RAG endpoints whenever possible.
• Enforce an explicit allowlist of approved HTTPS origins, including permitted hostnames and ports.
• Reject non-HTTPS schemes, URLs containing embedded credentials, malformed hosts, and unsupported ports.
• Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
• Revalidate the resolved destination immediately before connection to reduce DNS rebinding risk.
• Disable redirects by default. If redirects are necessary, validate every redirect target using the same scheme, origin, DNS, and IP restrictions.
• Apply outbound firewall or proxy controls so the agent cannot reach internal control-plane and metadata services.
• Set strict connection and response timeouts, response-size limits, and content-type restrictions.
• Require explicit user approval before contacting any endpoint outside the preconfigured trusted set, independently of the existing sensitive-data confirmation.
• Treat retrieved content as untrusted input. Preserve source provenance and do not automatically regard arbitrary endpoint responses as authoritative.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep