BATNA & ZOPA

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.5

Overview

The skill provides negotiation coaching, but it should be reviewed because it asks agents to paste real-use negotiation failures back into the skill file.

Review before installing. The negotiation framework itself is conventional, but the skill should not be allowed to update its own instruction file with real user negotiation details unless there is explicit consent, redaction, and human review.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:103

Finding

Persistent Skill Modification Using User-Derived Interaction Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 103
Vulnerability Type: Persistent memory poisoning through unvalidated interaction-derived content
Risk Level: Medium

Complete Code Snippet:

markdown

| *→ Add [O] entries here after each real use — paste the actual failure pattern* | *What went wrong and why* |

Technical Analysis

The instruction directs an agent to update the skill after each real use by pasting an actual failure pattern into persistent skill content. Because the source material may originate from user-controlled conversations, this creates a path for untrusted text to enter state that is loaded in future sessions.

No validation, sanitization, confidentiality review, tenant isolation, approval step, or retention policy is specified. An attacker could construct a negotiation scenario containing instruction-like text and encourage the agent to classify that text as an observed failure pattern. If the agent has write access and follows this directive, the content could be incorporated into SKILL.md and subsequently interpreted as trusted skill guidance.

Negotiation interactions may also contain sensitive salary, fundraising, merger and acquisition, vendor, or commercial information. The instruction to paste the “actual” pattern creates an additional risk of retaining such information beyond the original session.

Attack Path

1. An attacker invokes the skill with a crafted negotiation scenario containing misleading rules or instruction-like content.
2. The interaction is presented as revealing an “actual failure pattern.”
3. Following SKILL.md:103, an agent with filesystem write access appends the attacker-influenced material to the persistent skill file.
4. The modified skill is loaded during later, unrelated sessions.
5. The persisted material affects future analysis or exposes retained details from the original interaction.

This path depends on the hosting agent ...[truncated 805 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the directive to paste observed interaction content directly into SKILL.md.
2. Keep the distributed skill package immutable at runtime and deny the agent write access to skill instruction files.
3. If operational learning is required, store observations in a separate, structured data store rather than executable or instruction-bearing Markdown.
4. Require explicit user consent before retaining any interaction-derived information.
5. Redact names, deal terms, financial figures, company information, credentials, and other sensitive data before storage.
6. Validate stored observations against a strict schema and reject instruction syntax, tool directives, links, embedded code, and role-changing language.
7. Isolate retained observations by user or tenant, enforce access controls, and establish expiration and deletion policies.
8. Require human review and provenance metadata before promoting an observation into trusted skill guidance.
9. Treat all learned content as quoted, non-authoritative data when it is displayed to an agent in future sessions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.