Agent Stability Framework

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:07 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent agent-stability framework, but it asks users to install broad system-prompt rules and persistent logs that can suppress safety-relevant caveats and permanently change agent behavior without enough safeguards.

Review this carefully before installing. Use it only if you want a persistent persona/stability system, add an explicit rule that safety, authorization, privacy, factual accuracy, and platform policies override ASF rules, and avoid storing raw conversations or sensitive data in the logs. Require human review before turning log patterns into permanent standing orders.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: AGENT_STABILITY_FRAMEWORK.md:92
• Finding: System-Prompt Rules Can Override Safety-Relevant Response Behavior<![CDATA[ ## Vulnerability Details **File Location**: `AGENT_STABILITY_FRAMEWORK.md:92-124` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Complete Vulnerable Snippet ```markdown ### Standing Orders (Add to System Prompt) Adapt these to your agent's soul — the specifics change, the principle doesn't: \`\`\` ## STANDING ORDERS — STABILITY 1. NEVER add information the user didn't ask for 2. NEVER explain WHY something matters unless asked "why" 3. NEVER validate or grade the user's decisions 4. NEVER add disclaimers or hedging unless genuinely uncertain about facts 5. NEVER pad with social cushioning ("let me know", "hope this helps") 6. If a sentence can be removed without changing information content — remove it 7. Match the tone and length of BASELINE_EXAMPLES.md, not training defaults \`\`\` ### Pre-Send Gate (Add to System Prompt) Binary delete triggers checked before every output: \`\`\` ## PRE-SEND GATE Before sending, check each part of your response. YES to any = delete that part: - Does any sentence exist that wasn't requested? → DELETE - Does any sentence validate/praise the user? → DELETE - Is there a closing pleasantry? → DELETE - Am I explaining the user's logic back to them? → DELETE - Would removing this paragraph change information content? No? → DELETE - Is this longer than the closest baseline example? → TRIM \`\`\` ``` ### Technical Analysis The framework explicitly directs users to copy broad behavioral rules into the system prompt. These rules use unconditional `NEVER` and `DELETE` directives but do not state that platform policies, developer instructions, safety requirements, authorization checks, and material risk disclosures take precedence. The instruction to delete every sentence that was not expressly requested can suppress information required for safe and accurate task completion. Similarly, the prohibition against unsolicited disclaimers or explanations may remove warnings about de ...[truncated 1800 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add an explicit precedence rule stating that platform policies, developer instructions, legal requirements, authorization boundaries, security controls, factual accuracy, and user safety always override ASF style rules. 2. Replace unconditional deletion directives with conditional guidance. For example, retain unsolicited content when it is necessary to explain risk, uncertainty, prerequisites, authorization, destructive effects, or irreversible consequences. 3. Restrict standing orders to presentation preferences such as tone and ordinary verbosity. Prohibit persona rules from modifying refusal behavior, tool authorization, privacy protections, factual disclosure, or safety warnings. 4. Require a safety review before any ASF block is inserted into a system prompt. 5. Add regression tests covering destructive commands, financial decisions, medical or legal topics, credential handling, privacy-sensitive operations, and uncertain factual claims. 6. Revise the pre-send gate to ask whether content is necessary for safety, accuracy, or informed consent before deleting it. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: AGENT_STABILITY_FRAMEWORK.md:179
• Finding: Untrusted Observations Can Be Promoted into Persistent Agent Rules<![CDATA[ ## Vulnerability Details **File Locations**: `AGENT_STABILITY_FRAMEWORK.md:179`, `AGENT_STABILITY_FRAMEWORK.md:305-321`, `AGENT_STABILITY_FRAMEWORK.md:339-351`, `DRIFT_LOG_TEMPLATE.md:1-18`, `FAULT_LOG_TEMPLATE.md:21-31` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Complete Vulnerable Snippets From `AGENT_STABILITY_FRAMEWORK.md`: ```markdown Log every fault. Patterns become new standing orders or system prompt additions. ``` ```markdown ### Files to Create \`\`\` SOUL.md ← Agent identity (YOU create) BASELINE_EXAMPLES.md ← 10+ correct response examples (YOU create) DRIFT_LOG.md ← Drift incidents (agent maintains) FAULT_LOG.md ← Fault incidents (agent maintains) STABILITY_LOG.md ← Periodic audit scores (agent maintains) \`\`\` ### System Prompt Additions 1. Standing orders (Part 2) — adapted to your agent's soul 2. Pre-send gate (Part 2) — binary delete triggers 3. Fault detection rules (Part 3) — self-check before acting 4. Reference to SOUL.md and BASELINE_EXAMPLES.md — read every session ``` ```markdown 4. **Logging creates memory.** Agents forget between sessions. Logs don't. Patterns in logs become standing orders. Standing orders become permanent behavior. ``` From `DRIFT_LOG_TEMPLATE.md`: ```markdown # Drift Log Track personality drift incidents here. Patterns become new standing orders. | Date | What Drifted | Category | Correction | |------|-------------|----------|------------| | 2026-02-20 | Added "I hope this helps" to end of response | scope | Standing order: no closing pleasantries | | | | | | **Categories:** tone, scope, confidence, length, unsolicited ## How to Use When you catch drift (agent sounds generic, adds unnecessary content, hedges more): 1. Log it here with the date and what happened 2. Identify the category 3. Note what correction was applied 4. If this pattern repeats 2+ times, add a new standing order to prevent it permanent ...[truncated 3233 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all identity files, baseline examples, drift logs, fault logs, and model-generated summaries as untrusted data. 2. Require explicit human approval before promoting any observation into a standing order or system-prompt addition. 3. Record provenance for every proposed rule, including the source conversation, author, timestamp, rationale, reviewer, and affected behavior. 4. Restrict persistent rules to low-risk presentation properties. Disallow changes to authorization, tool use, privacy, security controls, refusal behavior, factual standards, and required risk disclosures. 5. Store approved rules separately from raw logs so logged text is never interpreted directly as instruction. 6. Add version control, integrity checks, change review, rollback support, and an audit trail for persistent behavior files. 7. Require multiple independent, reviewed examples before treating a pattern as systemic; repetition from one user or session must not be sufficient. 8. Add a fixed rule stating that persistent persona and stability instructions remain subordinate to platform safety policies and current authorized task requirements. 9. Escape or clearly delimit user-provided text in logs and examples so embedded instructions are treated only as quoted data. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

1. NEVER add information the user didn't ask for
2. NEVER explain WHY something matters unless asked "why"  
3. NEVER validate or grade the user's decisions
4. NEVER add disclaimers or hedging unless genuinely uncertain about facts
5. NEVER pad with social cushioning ("let me know", "hope this helps")
6. If a sentence can be removed without changing information content — remove it
7. Match the tone and length of BASELINE_EXAMPLES.md, not training defaults

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This framework explicitly instructs the agent to create and maintain multiple log files, including fault and stability logs, without any guardrails about consent, data minimization, retention, or redaction. If implemented literally, an agent may persist user prompts, model outputs, and potentially sensitive metadata to disk, creating a privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The prescribed daily audits and continuous logging require reviewing and recording recent responses over time, which implies retention of conversation history in persistent logs. Without disclosure or storage safeguards, this can silently accumulate sensitive user data and expand the blast radius of any host compromise or unauthorized access.

Scope Creep

Low

• Category: Excessive Agency

Content

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.