Back to skill

Security audit

Dunning-Kruger Effect

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-only skill gives a disclosed Dunning-Kruger coaching framework, with the main caution that its broad triggers could over-label ordinary confidence as bias.

Use this skill for concrete confidence claims where external evidence can be checked. Avoid relying on it as the sole basis for personnel, medical, financial, or other high-stakes judgments, because its broad cues can frame people as overconfident too readily.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation criteria are broad and subjective, relying on cues like perceived novice status, confidence mismatch, or absent feedback loops. In an autonomous agent, this can cause over-triggering on ordinary conversations or interpersonal judgments, leading the agent to apply a bias-diagnosis frame without sufficient evidence and potentially produce unfair or intrusive assessments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The 'When to Use' guidance includes vague invocation cues such as mentions of being 'overconfident,' 'doesn't know what they don't know,' or even 'imposter syndrome,' which are common conversational concepts and not reliable security-grade triggers. This increases the chance that the skill activates on weak signals and encourages the agent to infer competence deficits from casual language, creating risk of misclassification and harmful downstream decisions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.