Minimalist

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent minimalist-coding style guide, but it also tells agents to run a repository-controlled logging script without clear user approval.

Install only if you want a persistent minimalist coding style. Before using it in repositories you do not fully trust, disable or ignore the log-rejection command unless you have inspected scripts/log-rejection.js and explicitly want it run. Be aware that the skill may continue shaping coding responses until turned off.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:76

Finding

Automatic Execution of an Untrusted Repository-Controlled Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–80
Vulnerability Type: Untrusted local script execution
Risk Level: High

Vulnerable Code Snippet

markdown

When you *reject* scope or a dependency, say so explicitly in one line
("skipped X: YAGNI / stdlib covers it") so the human can veto, and log it:
`node scripts/log-rejection.js "<step>" "<item>" ["<replaced with>"] [--loc <estimate>]`
(run from the repo root; skip silently if the script isn't present). Add
`--loc` only when you can reasonably size the rejected approach

Technical Analysis

The Skill directs the agent to run scripts/log-rejection.js from the repository root whenever it rejects scope or a dependency. That script is not included in the audited Skill package, so its content and integrity are outside the Skill's control. A target repository can create a file at that path containing arbitrary JavaScript.

Invoking the script through Node.js executes it with the agent process's effective privileges. Although the shown parameters are quoted, which reduces direct shell argument-injection risk, quoting does not protect against malicious code already present inside scripts/log-rejection.js.

The instruction to “skip silently if the script isn't present” also encourages execution without explicit disclosure or approval. Running repository-controlled executable code is unnecessary for the Skill's stated code-minimization purpose and creates a trust-boundary violation.

Attack Path

1. An attacker creates or modifies scripts/log-rejection.js in a repository that a victim will ask the agent to edit.
2. The script contains malicious JavaScript, such as logic that reads accessible files, modifies source code, extracts environment variables, or initiates network requests.
3. The victim activates or uses the Minimalist Skill for a coding task in that repository.
4. During the task, the agent rejects a proposed dependency or scope item under the Skill's subtract ...[truncated 928 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to execute scripts/log-rejection.js automatically.
2. Report rejected scope or dependencies through ordinary response text rather than executable repository hooks.
3. If durable logging is required, use a trusted platform-provided logging mechanism that does not execute repository-controlled code.
4. If repository script execution is indispensable:
   • Clearly disclose the proposed command to the user.
   • Require explicit approval immediately before execution.
   • Inspect the entire script and its imports before running it.
   • Verify that the file is trusted and has not changed between review and execution.
   • Run it in a sandbox with minimal filesystem, process, environment, and network access.
   • Avoid exposing secrets or credentials to the subprocess.
5. Replace “skip silently” with transparent behavior so users are informed whether any executable hook was found or considered.

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The persistence rule says the skill is active on every response by default until explicitly disabled, which is a strong instruction-retention mechanism. In an agent setting, this can cause the skill to bleed into unrelated future tasks, suppress normal instruction hierarchy, and bias outputs even when the user did not request minimalist behavior for the current step.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

- Input validation and sanitization on every trust boundary.
- AuthN/AuthZ checks. Rate limits. CSRF/XSS/SQL-injection protections.
- Error handling on operations that can actually fail (I/O, network, parsing untrusted data).
- Resource cleanup (close/release/finally), transactionality where partial writes corrupt state.
- Failing tests are never "fixed" by deleting the test.
- Secrets never inlined, never logged.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares itself applicable to essentially any coding task and also to broad conversational cues like complaints about over-engineering or boilerplate. That creates an overly broad trigger surface, increasing the chance the skill activates in contexts where its constraints are not appropriate, which can override user intent or interfere with safer, more specialized instructions.

Content

No source excerpt is available for this finding.