T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:42- Finding
Mandatory Skill Instructions Hijack Agent Workflow and Tool Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
PAI
Security checks for vulnerabilities and agentic risk
Overview
This skill is a broad personal-AI orchestration system, but it asks for too much automatic control over agent behavior, credentials, memory, tools, and local execution.
Install only if you deliberately want a high-control PAI environment that can shape every agent response, run local notification commands, manage persistent memory, and execute local tooling. Review and disable the credential persistence, transcript harvesting, curl-to-shell installers, and unrestricted action capabilities before using it on a machine with real secrets or sensitive projects.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
Tools/pai.ts:455- Finding
Remote Installer Scripts Are Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:116- Finding
Skill Instructs Agents to Enumerate and Persist Credentials in Plaintext Environment Files
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
Tools/SessionHarvester.ts:153- Finding
Unsanitized Conversation Content Is Written Into Persistent Agent Memory
- Content
View full analysis
line.trim()); let previousContext = ''; for (const line of lines) { try { const entry = JSON.parse(line) as ProjectsEntry; if (!entry.message?.content) continue; const textContent = extractTextContent(entry.message.content); if (!textContent || textContent.length < 20) continue; const timestamp = entry.timestamp || new Date().toISOString(); if (entry.type === 'user') { const { matches, matchedPattern } = matchesPatterns(textContent, CORRECTION_PATTERNS); if (matches) { learnings.push({ sessionId, timestamp, category: getLearningCategory(textContent), type: 'correction', context: previousContext.slice(0, 200), content: textContent.slice(0, 500), source: matchedPattern || 'correction' }); } previousContext = textContent; } if (entry.type === 'assistant') { const { matches: insightMatch, matchedPattern: insightPattern } = matchesPatterns(textContent, INSIGHT_PATTERNS); ...[truncated 3112 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
ACTIONS/lib/runner.v2.ts:61- Finding
Action Manifests Receive Unrestricted Shell and Arbitrary Filesystem Capabilities
- Content
View full analysis
{ const capabilities: ActionCapabilities = {}; for (const cap of required) { switch (cap) { case "llm": capabilities.llm = await createLocalLLM(); break; case "fetch": capabilities.fetch = fetch; break; case "shell": capabilities.shell = async (cmd: string) => { const { $ } = await import("bun"); try { const result = await $`sh -c ${cmd}`.quiet(); return { stdout: result.text(), stderr: "", code: 0 }; } catch (err: unknown) { const e = err as { stderr?: { toString(): string }; exitCode?: number }; return { stdout: "", stderr: e.stderr?.toString() || String(err), code: e.exitCode || 1, }; } }; break; case "readFile": capabilities.readFile = async (path: string) => { return Bun.file(path).text(); }; break; case "writeFile": capabilities.writeFile = async (path: string, content: string) => { await Bun.write(path, content); }; break; } } return capabilities; } ``` User actions are resolved before framework actions: ```ts if (name.startsWith("A_")) { const userPath = join(USER_ACTIONS_DIR, name); try { await readFile(join(userPath, "action.json"), "utf-8"); return userPath; } catch {} const systemPath = join(ACTIONS_DIR, name); try { await readFile(join(systemPath, "action.json"), "utf-8"); return systemPath; } catch { return nul ...[truncated 2270 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (1253)
Ssd 3
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The recovery workflow explicitly tells the agent to audit auth tokens and API keys and persist critical env vars before deployment commands. This is a direct secret-handling anti-pattern that can expose credentials in memory, logs, or files and materially increases the chance of compromise.
- Content
Ssd 3
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The post-compaction instructions explicitly call for auditing auth tokens and API keys and persisting critical environment variables to
.env. This is a direct secret-handling anti-pattern that can move high-value credentials from transient process state into durable storage, dramatically increasing exposure and compromise risk.- Content
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
ts export async function findAction(name: string): Promise<string | null> { // New flat format: A_EXTRACT_TRANSCRIPT if (name.startsWith("A_")) { // Check USER/ACTIONS first (personal actions override system) const userPath = join(USER_ACTIONS_DIR, name); try { await readFile(join(userPath, "action.json"), "utf-8");
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md export async function findAction(name: string): Promise<string | null> { // New flat format: A_EXTRACT_TRANSCRIPT if (name.startsWith("A_")) { // Check USER/ACTIONS first (personal actions override system) const userPath = join(USER_ACTIONS_DIR, name); try { await readFile(join(userPath, "action.json"), "utf-8");
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## Use AskUserQuestion for Security-Sensitive Ops **Statement:** Before destructive commands (force push, rm -rf, DROP DATABASE, terraform destroy), use AskUserQuestion with context about consequences—don't rely on hook prompts alone. **Bad:** Run `git push --force origin main`. Hook shows generic "Proceed?" User clicks through without context. **Correct:** AskUserQuestion: "Force push to main rewrites history, may lose collaborator commits. Proceed?" User makes informed decision. ## Read Before Modifying
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## Use AskUserQuestion for Security-Sensitive Ops **Statement:** Before destructive commands (force push, rm -rf, DROP DATABASE, terraform destroy), use AskUserQuestion with context about consequences—don't rely on hook prompts alone. **Bad:** Run `git push --force origin main`. Hook shows generic "Proceed?" User clicks through without context. **Correct:** AskUserQuestion: "Force push to main rewrites history, may lose collaborator commits. Proceed?" User makes informed decision. ## Read Before Modifying
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## Use AskUserQuestion for Security-Sensitive Ops **Statement:** Before destructive commands (force push, rm -rf, DROP DATABASE, terraform destroy), use AskUserQuestion with context about consequences—don't rely on hook prompts alone. **Bad:** Run `git push --force origin main`. Hook shows generic "Proceed?" User clicks through without context. **Correct:** AskUserQuestion: "Force push to main rewrites history, may lose collaborator commits. Proceed?" User makes informed decision. ## Read Before Modifying
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## Use AskUserQuestion for Security-Sensitive Ops **Statement:** Before destructive commands (force push, rm -rf, DROP DATABASE, terraform destroy), use AskUserQuestion with context about consequences—don't rely on hook prompts alone. **Bad:** Run `git push --force origin main`. Hook shows generic "Proceed?" User clicks through without context. **Correct:** AskUserQuestion: "Force push to main rewrites history, may lose collaborator commits. Proceed?" User makes informed decision. ## Read Before Modifying
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md evals prompt create --use-case newsletter-summary --version v1.0.0 --file prompt.txt # Run operations evals run --use-case newsletter-summary --model claude-3-5-sonnet --prompt v1.0.0 evals run --use-case newsletter-summary --all-models --prompt v1.0.0 # Query operations
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md # Query operations evals query runs --use-case newsletter-summary --limit 10 evals query runs --model gpt-4o --score-min 0.8 evals query runs --since 2025-11-01 # Compare operations
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md # Compare operations evals compare runs --run-a <id> --run-b <id> evals compare models --use-case newsletter-summary --prompt v1.0.0 evals compare prompts --use-case newsletter-summary --model claude-3-5-sonnet # List operations evals list use-cases
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
Examples:
evals use-case create --name foo evals test-case add --use-case foo --file test.json evals run --use-case foo --model claude-3-5-sonnet
text **2. Output Formats**
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md User: "Run evals for newsletter summary with Claude and GPT-4, then compare them" AI executes: 1. evals run --use-case newsletter-summary --model claude-3-5-sonnet 2. evals run --use-case newsletter-summary --model gpt-4o 3. evals compare models --use-case newsletter-summary 4. Summarize results in structured format
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md AI executes: 1. evals run --use-case newsletter-summary --model claude-3-5-sonnet 2. evals run --use-case newsletter-summary --model gpt-4o 3. evals compare models --use-case newsletter-summary 4. Summarize results in structured format
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md **Architecture:** - **SYSTEM rules** (`SYSTEM/AISTEERINGRULES.md`): Universal rules. Always active. Cannot be overridden. - **USER rules** (`USER/AISTEERINGRULES.md`): Personal customizations. Extend and can override SYSTEM rules for user-specific behaviors. **Loading:** Both files are concatenated at runtime. SYSTEM loads first, USER extends. Conflicts resolve in USER's favor.
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md **Architecture:** - **SYSTEM rules** (`SYSTEM/AISTEERINGRULES.md`): Universal rules. Always active. Cannot be overridden. - **USER rules** (`USER/AISTEERINGRULES.md`): Personal customizations. Extend and can override SYSTEM rules for user-specific behaviors. **Loading:** Both files are concatenated at runtime. SYSTEM loads first, USER extends. Conflicts resolve in USER's favor.
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md **Architecture:** - **SYSTEM rules** (`SYSTEM/AISTEERINGRULES.md`): Universal rules. Always active. Cannot be overridden. - **USER rules** (`USER/AISTEERINGRULES.md`): Personal customizations. Extend and can override SYSTEM rules for user-specific behaviors. **Loading:** Both files are concatenated at runtime. SYSTEM loads first, USER extends. Conflicts resolve in USER's favor.
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill self-describes as an unrestricted, ASI-level general solver for everyday requests, with no activation boundaries or domain constraints. That broad framing encourages the agent to supersede normal task routing and apply this skill universally, increasing the chance of prompt hijacking, policy interference, and inappropriate handling of unrelated requests.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The response format explicitly says learnings will be saved in memory to improve future behavior, which is a direct instruction to retain potentially sensitive interaction data. In a general-purpose skill, this creates a meaningful risk of unauthorized memory formation, cross-request contamination, and privacy or confidentiality breaches.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file uses repeated mandatory language such as applying the algorithm to every response with no meaningful scoping. In a skill system, universal mandates are dangerous because they can coerce the model into ignoring higher-priority orchestration, force unnecessary tool usage, and create denial-of-service style verbosity or workflow lock-in.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that every response must use the algorithm and mandatory format, with only minimal exceptions, making activation effectively global. Overly broad activation increases the chance that the skill hijacks unrelated interactions, injects unsafe behaviors into benign conversations, and normalizes unnecessary tool or context access.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill defines itself as an "ASI-level general problem solver" that should reinterpret everyday requests and apply itself broadly, which creates an almost universal activation surface. A broadly-triggering orchestration skill can hijack unrelated tasks, override safer task-specific behaviors, and increase the chance that users are pushed into tool use, task mutation, or hidden workflow steps without clear intent boundaries.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill presents itself as applicable to effectively any task and frames itself as the mandatory container for work before execution. Overbroad invocation conditions are dangerous because they can hijack unrelated workflows, override safer task-specific policies, and pressure the agent into unnecessary tool use and expansive context gathering.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file uses mandatory language such as requiring the algorithm for every response, even while only weakly exempting a few simple cases. This creates prompt-scope overreach: a generic skill can dominate the assistant's behavior across sessions, interfere with safer instructions, and normalize unconditional tool orchestration.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill declares itself the universal container for all requests with 'no exceptions,' effectively overriding normal routing and scope boundaries. This kind of broad activation increases the chance the skill will intercept unrelated prompts and force unsafe behaviors such as tool use, context mining, or side-effectful workflows when they are not appropriate.
- Content